UBUNTU-CVE-2019-3809
A flaw was found in Moodle versions 3.1 to 3.1.15 and earlier unsupported versions. The mybackpack functionality allowed setting the URL of badges, when it should be restricted to the Mozilla Open Badges backpack URL. This resulted in the possibility of blind SSRF via requests made by the page.
UBUNTU-CVE-2019-3809
Primary source · Revision 1
Imported from structured advisory data. Source references identify upstream records or fields; verify affected versions and your deployed configuration.
Security context
Source reference: osv:UBUNTU-CVE-2019-3809
moodle
Source reference: /affected/0/package/name
- Affected versions
- 2.7.9+dfsg-1
Source reference:
/affected/0/versions2.7.10+dfsg-1Source reference:
/affected/0/versions2.7.11+dfsg-1Source reference:
/affected/0/versions2.7.11+dfsg-2Source reference:
/affected/0/versions2.7.12+dfsg-1Source reference:
/affected/0/versions3.0.3+dfsg-0ubuntu1Source reference:
/affected/0/versions - Fixed versions
- 3.0.3+dfsg-0ubuntu1+esm1
Source reference:
/affected/0/ranges - Prerequisites
- Not stated in this record
moodle
Source reference: /affected/1/package/name
- Affected versions
- 3.0.3+dfsg-0ubuntu1
Source reference:
/affected/1/versions - Fixed versions
- 3.0.3+dfsg-0ubuntu1+esm1
Source reference:
/affected/1/ranges - Prerequisites
- Not stated in this record
Structured affected-version data
Original package identities and version rules from this source.
[
{
"ranges": [
{
"type": "ECOSYSTEM",
"events": [
{
"introduced": "0"
},
{
"fixed": "3.0.3+dfsg-0ubuntu1+esm1"
}
]
}
],
"package": {
"name": "moodle",
"purl": "pkg:deb/ubuntu/moodle?arch=source&distro=esm-apps-legacy%2Fxenial",
"ecosystem": "Ubuntu:Pro:16.04:LTS"
},
"versions": [
"2.7.9+dfsg-1",
"2.7.10+dfsg-1",
"2.7.11+dfsg-1",
"2.7.11+dfsg-2",
"2.7.12+dfsg-1",
"3.0.3+dfsg-0ubuntu1"
],
"database_specific": {
"source": "https://github.com/canonical/ubuntu-security-notices/blob/main/osv/cve/2019/UBUNTU-CVE-2019-3809.json"
},
"ecosystem_specific": {
"binaries": [
{
"binary_name": "moodle",
"binary_version": "3.0.3+dfsg-0ubuntu1+esm1"
}
],
"availability": "Available with Ubuntu Pro with Legacy support add-on: https://ubuntu.com/pro"
}
},
{
"ranges": [
{
"type": "ECOSYSTEM",
"events": [
{
"introduced": "0"
},
{
"fixed": "3.0.3+dfsg-0ubuntu1+esm1"
}
]
}
],
"package": {
"name": "moodle",
"purl": "pkg:deb/ubuntu/moodle?arch=source&distro=esm-apps%2Fbionic",
"ecosystem": "Ubuntu:Pro:18.04:LTS"
},
"versions": [
"3.0.3+dfsg-0ubuntu1"
],
"database_specific": {
"source": "https://github.com/canonical/ubuntu-security-notices/blob/main/osv/cve/2019/UBUNTU-CVE-2019-3809.json"
},
"ecosystem_specific": {
"binaries": [
{
"binary_name": "moodle",
"binary_version": "3.0.3+dfsg-0ubuntu1+esm1"
}
],
"availability": "Available with Ubuntu Pro: https://ubuntu.com/pro"
}
}
]Publisher severity
No explicit severity was provided.
- Event
- #14185 · Revision 1
- Added to Heist Feed
- Publisher date