Moodle Users could elevate their role when accessing the LTI tool on a provider site
A vulnerability was found in moodle before versions 3.6.3, 3.5.5 and 3.4.8. Users could assign themselves an escalated role within courses or content accessed via LTI, by modifying the request to the LTI publisher site.
01
beschreibt (1)
Zugehörige CVEs.
| ID | Schweregrad | ausnutzbar | ||
|---|---|---|---|---|
| CVE-2019-3849US | high8.8 | — | ||
A vulnerability was found in moodle before versions 3.6.3, 3.5.5 and 3.4.8. Users could assign themselves an escalated role within courses or content accessed via LTI, by modifying… | ||||
02
Referenzen
Externe Belege — Patches, Meldungen, Analysen.
- https://bugzilla.redhat.com/show_bug.cgi?id=CVE-2019-3849WEB
- https://github.com/moodle/moodlePACKAGE
- https://github.com/moodle/moodle/commit/427463a52574e4b3bcbe1c65c49066438770641eWEB
- https://github.com/moodle/moodle/commit/430f685834cef190bdf58afabe79e765d596890dWEB
- https://github.com/moodle/moodle/commit/723d1a747555b795ed53a0fad01da455797bb78fWEB
- https://github.com/moodle/moodle/commit/898d5d05a0c3ae6795db0241bf3cb5951213d45cWEB
- https://github.com/moodle/moodle/commit/b77dcd23d8e39265b5c096f0d947764c02d832c8WEB
- https://github.com/moodle/moodle/commit/cd3060d941a051931eb2613b25bafb0108665895WEB
scry
Advisories wie diese benennen die exponierten Produkte, die Angreifer auf Ihrer Angriffsfläche ins Visier nehmen. Sehen Sie mit einem kostenlosen Passiv-Scan, was exponiert ist.
Kostenloser Scan