CVE-2019-3808

Severity: medium (CVSS 5.4 v3.1)
Exploited in the wild: not listed in CISA KEV
EPSS: 1.2% probability of exploitation in the next 30 days
Public exploit or detection template: none known
Published: 2019-03-25 · updated 2026-06-17
Weakness: CWE-79

Description

A flaw was found in Moodle versions 3.6 to 3.6.1, 3.5 to 3.5.3, 3.4 to 3.4.6, 3.1 to 3.1.15 and earlier unsupported versions. The 'manage groups' capability did not have the 'XSS risk' flag assigned to it, but does have that access in certain places. Note that the capability is intended for use by trusted users, and is only assigned to teachers and managers by default.

Affected products

Moodle: from 3.1.0 through 3.1.15; from 3.4.0 through 3.4.6; from 3.5.0 through 3.5.3; 3.6.0, 3.6.1

References

http://git.moodle.org/gw?p=moodle.git&a=search&h=HEAD&st=commit&s=MDL-64395
https://bugzilla.redhat.com/show_bug.cgi?id=CVE-2019-3808
https://moodle.org/mod/forum/discuss.php?d=381228#p1536765
http://git.moodle.org/gw?p=moodle.git&a=search&h=HEAD&st=commit&s=MDL-64395
https://bugzilla.redhat.com/show_bug.cgi?id=CVE-2019-3808
https://moodle.org/mod/forum/discuss.php?d=381228#p1536765

Get alerted when CVE-2019-3808 or the next vulnerability affects your stack