CVE-2018-16854: CSRF
Published Nov 26, 2018
·Updated
A flaw was found in moodle versions 3.5 to 3.5.2, 3.4 to 3.4.5, 3.3 to 3.3.8, 3.1 to 3.1.14 and earlier. The login form is not protected by a token to prevent login cross-site request forgery. Fixed versions include 3.6, 3.5.3, 3.4.6, 3.3.9 and 3.1.15.
Affected Software
9 affected componentsFixes available
composer/moodle/moodle>=3.5<3.5.3
3.5.3
composer/moodle/moodle>=3.4<3.4.6
3.4.6
composer/moodle/moodle>=3.3<3.3.9
3.3.9
composer/moodle/moodle>=3.1<3.1.15
3.1.15
Moodle moodle<=3.0.10
Moodle moodle>=3.1.0<3.1.15
Moodle moodle>=3.3.0<3.3.9
Moodle moodle>=3.4.0<3.4.6
Moodle moodle>=3.5.0<3.5.3
Remediation
Patch Available
Event History
Nov 26, 2018
CVE Published
via MITRE·05:00 PM
Data Sourced
via MITRE·05:00 PM
DescriptionSeverityWeakness
May 13, 2022
Advisory Published
via GitHub·01:34 AM
Frequently Asked Questions
1
What is the severity of CVE-2018-16854?
CVE-2018-16854 is classified as a medium severity vulnerability due to its potential exploitation via cross-site request forgery.
2
How do I fix CVE-2018-16854?
To fix CVE-2018-16854, upgrade Moodle to versions 3.5.3, 3.4.6, 3.3.9, or 3.1.15.
3
What versions of Moodle are affected by CVE-2018-16854?
CVE-2018-16854 affects Moodle versions 3.5 to 3.5.2, 3.4 to 3.4.5, 3.3 to 3.3.8, and 3.1 to 3.1.14 and earlier.
4
What type of attack does CVE-2018-16854 facilitate?
CVE-2018-16854 facilitates cross-site request forgery attacks due to the lack of a protective token on the login form.
5
Is there a patch available for CVE-2018-16854?
Yes, a patch is available in the fixed versions of Moodle.