CVE-2019-3849: High severity moodle vulnerability
Published Mar 26, 2019
·Updated
A vulnerability was found in moodle before versions 3.6.3, 3.5.5 and 3.4.8. Users could assign themselves an escalated role within courses or content accessed via LTI, by modifying the request to the LTI publisher site.
Affected Software
6 affected componentsFixes available
composer/moodle/moodle>=3.6<3.6.3
3.6.3
composer/moodle/moodle>=3.5<3.5.5
3.5.5
composer/moodle/moodle<3.4.8
3.4.8
Moodle moodle<3.4.8
Moodle moodle>=3.5.0<3.5.5
Moodle moodle>=3.6.0<3.6.3
Remediation
Patch Available
Patch Available
Event History
Mar 26, 2019
CVE Published
via MITRE·05:46 PM
Data Sourced
via MITRE·05:46 PM
DescriptionSeverityWeakness
Data Sourced
via NVD·06:29 PM
RemedyDescriptionSeverityWeaknessAffected Software
May 13, 2022
Advisory Published
via GitHub·01:14 AM
Frequently Asked Questions
1
What is the severity of CVE-2019-3849?
CVE-2019-3849 has been classified as a medium severity vulnerability due to its potential to allow unauthorized role escalation.
2
How do I fix CVE-2019-3849?
To fix CVE-2019-3849, update Moodle to version 3.6.3, 3.5.5, or 3.4.8.
3
What causes the vulnerability CVE-2019-3849?
CVE-2019-3849 is caused by a flaw that allows users to modify requests to the LTI publisher site, enabling self-assigned role escalation.
4
Which Moodle versions are affected by CVE-2019-3849?
CVE-2019-3849 affects Moodle versions prior to 3.6.3, 3.5.5, and 3.4.8.
5
Can CVE-2019-3849 lead to data breaches in Moodle?
Yes, CVE-2019-3849 could potentially lead to data breaches as it allows unauthorized users to gain escalated privileges.