Moodle CVE-2019-3848 Unauthorized Access Vulnerability

Bugtraq ID:	107477
Class:	Design Error
CVE:	CVE-2019-3848
Remote:	Yes
Local:	No
Published:	Mar 19 2019 12:00AM
Updated:	Mar 19 2019 12:00AM
Credit:	Juan Leyva
Vulnerable:	Moodle Moodle 3.6.2 Moodle Moodle 3.6.1 Moodle Moodle 3.5.4 Moodle Moodle 3.5.3 Moodle Moodle 3.5.2 Moodle Moodle 3.5.1 Moodle Moodle 3.4.7 Moodle Moodle 3.4.6 Moodle Moodle 3.4.5 Moodle Moodle 3.4.4 Moodle Moodle 3.4.3 Moodle Moodle 3.4.2 Moodle Moodle 3.6 Moodle Moodle 3.5 Moodle Moodle 3.4.1 Moodle Moodle 3.4
Not Vulnerable:	Moodle Moodle 3.6.3 Moodle Moodle 3.5.5 Moodle Moodle 3.4.8

Moodle CVE-2019-3848 Unauthorized Access Vulnerability

Moodle is prone to an unauthorized-access vulnerability.

Attackers can exploit this issue to gain unauthorized access and perform unauthorized actions. This may aid in further attacks.

Moodle versions 3.6 through 3.6.2, 3.5 through 3.5.4 and 3.4 through 3.4.7 are vulnerable.

Moodle CVE-2019-3848 Unauthorized Access Vulnerability

Solution:
Updates are available. Please see the references or vendor advisory for more information.

Moodle CVE-2019-3848 Unauthorized Access Vulnerability

References:

• Moodle Homepage (Moodle)
  
• MSA-19-0005: Logged in users could view all calendar events (Moodle)