What is GHSA-wv9c-pfpm-4wc5?

GHSA-wv9c-pfpm-4wc5 is a security advisory published by GitHub Security Advisories with High severity. Moodle CSRF Vulnerability

Which CVE IDs does GHSA-wv9c-pfpm-4wc5 cover?

GHSA-wv9c-pfpm-4wc5 covers the following CVE IDs: CVE-2019-10186. Each CVE has its own detail page on EchelonGraph Pulse with the synthesized EG score.

What is the CVSS v3 score of GHSA-wv9c-pfpm-4wc5?

GHSA-wv9c-pfpm-4wc5 has a CVSS v3 base score of 8.8, published by GitHub Security Advisories.

Which products are affected by GHSA-wv9c-pfpm-4wc5?

GHSA-wv9c-pfpm-4wc5 affects 3 products, including: composer/moodle/moodle:\u003e= 3.6.0, \u003c= 3.6.4; composer/moodle/moodle:= 3.7.0; composer/moodle/moodle:\u003e= 3.5.0, \u003c= 3.5.6.

GHSA-wv9c-pfpm-4wc5HighCVSS 8.8

Moodle CSRF Vulnerability

Vendor

GitHub Security Advisories

Published

May 24, 2022

Last Modified

August 25, 2023

🔗 CVE IDs covered (1)

CVE-2019-10186 →

📋 Description

A flaw was found in moodle before versions 3.7.1, 3.6.5, 3.5.7. A sesskey (CSRF) token was not being utilised by the XML loading/unloading admin tool.

🎯 Affected products3

composer/moodle/moodle:>= 3.6.0, <= 3.6.4
composer/moodle/moodle:= 3.7.0
composer/moodle/moodle:>= 3.5.0, <= 3.5.6

🔗 References (6)

https://nvd.nist.gov/vuln/detail/CVE-2019-10186
https://bugzilla.redhat.com/show_bug.cgi?id=CVE-2019-10186
https://moodle.org/mod/forum/discuss.php?d=388567#p1566329
https://github.com/moodle/moodle/commit/ea1ac3c7efbddbdb210ea4c75e7156c7d7ee914b
https://web.archive.org/web/20210125055044/https://www.securityfocus.com/bid/109175/
https://github.com/advisories/GHSA-wv9c-pfpm-4wc5