CVE-2019-3809CWE-352

A flaw was found in Moodle versions 3.1 to 3.1.15 and earlier unsupported versions

Medium · published March 25, 2019

CVSS v3.0
6.5
EPSS
1%
Percentile
57.3
In the wild
Unconfirmed
What it is

A flaw was found in Moodle versions 3.1 to 3.1.15 and earlier unsupported versions. The mybackpack functionality allowed setting the URL of badges, when it should be restricted to the Mozilla Open Badges backpack URL. This resulted in the possibility of blind SSRF via requests made by the page.

The record
Technical detail
CVSS v3.0
6.5 · MEDIUM
Vector
CVSS:3.0/AV:N/AC:L/PR:N/UI:N/S:U/C:N/I:L/A:L
CVSS v4.0
Not supplied
EPSS
0.00837 · 57.3th percentile
Weakness
CWE-352 · Cross-Site Request Forgery (CSRF)
Published
2019-03-25T17:38Z
EPSS history
Timeline
  • 25 MAR 17:38Z
    A flaw was found in Moodle versions 3.1 to 3.1.15 and earlier unsupported versions
    cvelistv5