Lucene search
Veracode Vulnerability DatabaseVERACODE:22255HistoryJan 08, 2020 - 1:17 a.m.
Authentication Bypass
2020-01-0801:17:10
Veracode Vulnerability Database
sca.analysiscenter.veracode.com
6
0.001 Low
EPSS
Percentile
24.9%
moodle is vulnerable to authentication bypass. The vulnerability exists as the removal of the cohort role assignment does not properly revoke the associated capabilities.
| CPE | Name | Operator | Version |
|---|---|---|---|
| moodle/moodle | le | 3.7.2 | |
| moodle/moodle | le | 3.6.6 | |
| moodle/moodle | le | 3.5.8 |
References
git.moodle.org/gw?p=moodle.git;a=blobdiff;f=admin/tool/cohortroles/classes/api.php;h=e94710feb10940bc9395e71036085867bf7a071c;hp=b3f0e541e0538cca48d154acab6f3df1b7554ae3;hb=7b5f4a62c18fd5bad6956828aade23e1f15b4be3;hpb=830eab425cdfa6511d7dff25b994c28d544ba8ea
bugzilla.redhat.com/show_bug.cgi?id=1788383
bugzilla.redhat.com/show_bug.cgi?id=CVE-2019-14879
github.com/moodle/moodle/commit/7b5f4a62c18fd5bad6956828aade23e1f15b4be3#diff-0c36149163cf50f3f79ee0e4318aa50a
Related
symantec
symantec
Moodle CVE-2019-14879 Security Bypass Vulnerability
2019-11-18 00:00:00
github
github
Moodle does not revoke role capabilities correctly
2022-05-24 17:05:43
cve
cve
CVE-2019-14879
2020-01-07 17:15:11
osv
osv
Moodle does not revoke role capabilities correctly
2022-05-24 17:05:43
CVE-2019-14879
2020-01-07 17:15:11
prion
prion
Design/Logic Flaw
2020-01-07 17:15:00
nvd
nvd
CVE-2019-14879
2020-01-07 17:15:11
ubuntucve
ubuntucve
CVE-2019-14879
2020-01-07 00:00:00
cvelist
cvelist
CVE-2019-14879
2020-01-07 16:23:01
openvas
openvas
Moodle < 3.5.9, 3.6.x < 3.6.7, 3.7.x < 3.7.3 Multiple Vulnerabilities
2019-11-20 00:00:00