CVE-2019-3852: Medium severity moodle vulnerability
Published Mar 26, 2019
·Updated
A vulnerability was found in moodle before version 3.6.3. The getwithcapabilityjoin and getusersbycapability functions were not taking context freezing into account when checking user capabilities
Affected Software
2 affected componentsFixes available
Moodle moodle<3.6.3
composer/moodle/moodle>=3.6<3.6.3
3.6.3
Remediation
Patch Available
Patch Available
Event History
Mar 26, 2019
CVE Published
via MITRE·05:47 PM
Data Sourced
via MITRE·05:47 PM
DescriptionSeverity
Data Sourced
via NVD·06:29 PM
RemedyDescriptionSeverityAffected Software
May 13, 2022
Advisory Published
via GitHub·01:22 AM
Frequently Asked Questions
1
What is the severity of CVE-2019-3852?
CVE-2019-3852 is classified as a moderate severity vulnerability affecting Moodle prior to version 3.6.3.
2
How do I fix CVE-2019-3852?
To remediate CVE-2019-3852, upgrade Moodle to version 3.6.3 or higher.
3
What functions are affected by CVE-2019-3852?
CVE-2019-3852 specifically affects the get_with_capability_join and get_users_by_capability functions in Moodle.
4
Which versions of Moodle are vulnerable to CVE-2019-3852?
Moodle versions prior to 3.6.3 are vulnerable to CVE-2019-3852.
5
What does CVE-2019-3852 exploit?
CVE-2019-3852 exploits a flaw in user capability checking, not considering context freezing.