Moodle Users could elevate their role when accessing the LTI tool on a provider site
A vulnerability was found in moodle before versions 3.6.3, 3.5.5 and 3.4.8. Users could assign themselves an escalated role within courses or content accessed via LTI, by modifying the request to the LTI publisher site.
01
describes (1)
Related CVEs.
| ID | severity | exploitable | ||
|---|---|---|---|---|
| CVE-2019-3849US | high8.8 | — | ||
A vulnerability was found in moodle before versions 3.6.3, 3.5.5 and 3.4.8. Users could assign themselves an escalated role within courses or content accessed via LTI, by modifying… | ||||
02
references
External citations — patches, advisories, analysis.
- https://bugzilla.redhat.com/show_bug.cgi?id=CVE-2019-3849WEB
- https://github.com/moodle/moodlePACKAGE
- https://github.com/moodle/moodle/commit/427463a52574e4b3bcbe1c65c49066438770641eWEB
- https://github.com/moodle/moodle/commit/430f685834cef190bdf58afabe79e765d596890dWEB
- https://github.com/moodle/moodle/commit/723d1a747555b795ed53a0fad01da455797bb78fWEB
- https://github.com/moodle/moodle/commit/898d5d05a0c3ae6795db0241bf3cb5951213d45cWEB
- https://github.com/moodle/moodle/commit/b77dcd23d8e39265b5c096f0d947764c02d832c8WEB
- https://github.com/moodle/moodle/commit/cd3060d941a051931eb2613b25bafb0108665895WEB
scry
Advisories like this name the exposed products attackers go after on your perimeter. See what is exposed on your perimeter with a free passive scan.
Free scan