VDB
CVE-2019-3847
CVE-2019-3847
PUBLISHED
CVSS 4.800000190734863 MEDIUM
A vulnerability was found in moodle before versions 3.6.3, 3.5.5, 3.4.8 and 3.1.17. Users with the "login as other users" capability (such as administrators/managers) can access other users' Dashboards, but the JavaScript those other users may have added to their Dashboard was not being escaped when being viewed by the user logging in on their behalf.
EPSS 2.22% · 81.5th percentile
Risk Scores
CVSS 3.1
4.800000190734863
CVSS:3.1/AV:N/AC:L/PR:H/UI:R/S:C/C:L/I:L/A:N
EPSS Score
2.22%
81.5th percentile
Affected Products
| Vendor | Product | Versions |
|---|---|---|
| Ubuntu:16.04:LTS | moodle | 0, *, * |
| Ubuntu:18.04:LTS | moodle | *, 0 |
Timeline
- Mar 19, 2019 CVE Published
- Apr 14, 2021 EPSS Score
- Jun 23, 2021 EPSS Score
- Oct 26, 2021 EPSS Score
- Dec 28, 2021 EPSS Score
- Feb 4, 2022 EPSS Score
- May 2, 2022 EPSS Score
- Jul 4, 2022 EPSS Score
- Sep 6, 2022 EPSS Score
- Jan 9, 2023 EPSS Score
- Mar 7, 2023 EPSS Score
- Mar 13, 2023 EPSS Score
References
- https://ubuntu.com/security/CVE-2019-3847 third-party-advisory
- https://bugzilla.redhat.com/show_bug.cgi?id=CVE-2019-3847 third-party-advisory
- https://moodle.org/mod/forum/discuss.php?d=384010#p1547742 third-party-advisory
- http://git.moodle.org/gw?p=moodle.git&a=search&h=HEAD&st=commit&s=MDL-63786 third-party-advisory
- https://www.cve.org/CVERecord?id=CVE-2019-3847 third-party-advisory