CVE-2019-14880: Critical severity moodle vulnerability

Q: What is the severity of CVE-2019-14880?

The severity of CVE-2019-14880 is considered moderate due to its potential for account compromise.

Q: How do I fix CVE-2019-14880?

To fix CVE-2019-14880, upgrade Moodle to version 3.7.3, 3.6.7, or 3.5.9 or later.

Q: Which versions of Moodle are affected by CVE-2019-14880?

CVE-2019-14880 affects Moodle versions 3.7 before 3.7.3, 3.6 before 3.6.7, and 3.5 before 3.5.9.

Q: What type of vulnerability is CVE-2019-14880?

CVE-2019-14880 is an OAuth 2 authentication vulnerability related to the verification of email address changes.

Q: What is the risk associated with CVE-2019-14880?

The risk associated with CVE-2019-14880 includes account compromise due to insufficient verification during user sign-up.

Published Mar 31, 2020

Updated

A vulnerability was found in Moodle versions 3.7 before 3.7.3, 3.6 before 3.6.7, 3.5 before 3.5.9 and earlier. OAuth 2 providers who do not verify users' email address changes require additional verification during sign-up to reduce the risk of account compromise.

Affected Software

6 affected componentsFixes available

composer/moodle/moodle>=3.5.0<3.5.9

3.5.9

composer/moodle/moodle>=3.6.0<3.6.7

3.6.7

composer/moodle/moodle>=3.7.0<3.7.3

3.7.3

Moodle moodle>=3.5<3.5.9

Moodle moodle>=3.6<3.6.7

Moodle moodle>=3.7<3.7.3

Event History

Mar 31, 2020

CVE Published

via MITRE·03:11 PM

Data Sourced

via MITRE·03:11 PM

DescriptionSeverityWeakness

May 24, 2022

Advisory Published

05:12 PM

Frequently Asked Questions

What is the severity of CVE-2019-14880?

The severity of CVE-2019-14880 is considered moderate due to its potential for account compromise.

How do I fix CVE-2019-14880?

To fix CVE-2019-14880, upgrade Moodle to version 3.7.3, 3.6.7, or 3.5.9 or later.

Which versions of Moodle are affected by CVE-2019-14880?