GHSA-xj5f-qv37-r9jcHighCVSS 8.8

Moodle Login CSRF vulnerability in login form

Published
May 13, 2022
Last Modified
April 23, 2024

🔗 CVE IDs covered (1)

CVE-2018-16854 →

📋 Description

A flaw was found in moodle versions 3.5 to 3.5.2, 3.4 to 3.4.5, 3.3 to 3.3.8, 3.1 to 3.1.14 and earlier. The login form is not protected by a token to prevent login cross-site request forgery. Fixed versions include 3.6, 3.5.3, 3.4.6, 3.3.9 and 3.1.15.

🎯 Affected products4

  • composer/moodle/moodle:>= 3.1, < 3.1.15
  • composer/moodle/moodle:>= 3.3, < 3.3.9
  • composer/moodle/moodle:>= 3.4, < 3.4.6
  • composer/moodle/moodle:>= 3.5, < 3.5.3

🔗 References (7)