CVE-2019-14828: Medium severity moodle vulnerability
A vulnerability was found in Moodle affecting 3.7 to 3.7.1, 3.6 to 3.6.5, 3.5 to 3.5.7 and earlier unsupported versions, where users with the capability to create courses were assigned as a teacher in those courses, regardless of whether they had the capability to be automatically assigned that role.
Affected Software
Remediation
Patch Available
Event History
Frequently Asked Questions
What is the severity of CVE-2019-14828?
CVE-2019-14828 has been classified as a high severity vulnerability affecting Moodle.
How do I fix CVE-2019-14828?
To fix CVE-2019-14828, upgrade Moodle to versions 3.7.2, 3.6.6, or 3.5.8, or a later version that addresses this issue.
What are the affected versions for CVE-2019-14828?
CVE-2019-14828 affects Moodle versions from 3.5.0 to 3.5.7, 3.6.0 to 3.6.5, and 3.7.0 to 3.7.1.
Who is vulnerable to CVE-2019-14828?
Users with the capability to create courses in affected Moodle versions are vulnerable to CVE-2019-14828.
What is the impact of CVE-2019-14828?
The impact of CVE-2019-14828 is that unauthorized users may be assigned the teacher role in courses, violating intended access controls.