CVE-2019-3847CWE-79

A vulnerability was found in moodle before versions 3.6.3, 3.5.5, 3.4.8 and 3.1.17

Medium · published March 27, 2019

CVSS v3.0
5.4
EPSS
2%
Percentile
82.6
In the wild
Unconfirmed
What it is

A vulnerability was found in moodle before versions 3.6.3, 3.5.5, 3.4.8 and 3.1.17. Users with the "login as other users" capability (such as administrators/managers) can access other users' Dashboards, but the JavaScript those other users may have added to their Dashboard was not being escaped when being viewed by the user logging in on their behalf.

The record
Technical detail
CVSS v3.0
5.4 · MEDIUM
Vector
CVSS:3.0/AV:N/AC:L/PR:L/UI:N/S:U/C:L/I:L/A:N
CVSS v4.0
Not supplied
EPSS
0.02224 · 82.6th percentile
Weakness
CWE-79 · Improper Neutralization of Input During Web Page Generation ('Cross-site Scripting')
Published
2019-03-27T00:00Z
EPSS history
Timeline
  • 27 MAR 00:00Z
    A vulnerability was found in moodle before versions 3.6.3, 3.5.5, 3.4.8 and 3.1.17
    cvelistv5