CVE-2019-3809

Severity: critical (CVSS 10.0 v3.0)
Exploited in the wild: not listed in CISA KEV
EPSS: 0.8% probability of exploitation in the next 30 days
Public exploit or detection template: none known
Published: 2019-03-25 · updated 2026-06-17
Weakness: CWE-352

Description

A flaw was found in Moodle versions 3.1 to 3.1.15 and earlier unsupported versions. The mybackpack functionality allowed setting the URL of badges, when it should be restricted to the Mozilla Open Badges backpack URL. This resulted in the possibility of blind SSRF via requests made by the page.

Affected products

Moodle: from 3.1.0 through 3.1.15

References

http://git.moodle.org/gw?p=moodle.git&a=search&h=HEAD&st=commit&s=MDL-64222
https://bugzilla.redhat.com/show_bug.cgi?id=CVE-2019-3809
https://moodle.org/mod/forum/discuss.php?d=381229#p1536766
http://git.moodle.org/gw?p=moodle.git&a=search&h=HEAD&st=commit&s=MDL-64222
https://bugzilla.redhat.com/show_bug.cgi?id=CVE-2019-3809
https://moodle.org/mod/forum/discuss.php?d=381229#p1536766

Get alerted when CVE-2019-3809 or the next vulnerability affects your stack