CVE-2019-10189

Description

CVE-2019-10189 is a flaw in Moodle's assignment module where teachers assigned to a specific group could modify group overrides belonging to other groups within the same assignment. The root cause is an insufficient permission check in the assignment override logic, which did not verify that the teacher was a member of the group they were modifying [1].

Exploitation

To exploit this vulnerability, an attacker must have a teacher role in a Moodle course with group override capabilities. The assignment must be set to use group overrides. The teacher can then submit a request to modify overrides for any group in that assignment, bypassing the intended group separation [3].

Impact

A malicious teacher could alter due dates, time limits, or other assignment settings for groups they are not a part of, potentially disrupting course activities or giving unfair advantages to certain students. This violates the principle of least privilege and the expected group isolation in collaborative learning environments.

Mitigation

Moodle has addressed this issue in versions 3.7.1, 3.6.5, and 3.5.7. Administrators should upgrade to these patched versions or later. There are no known workarounds, so immediate patching is recommended [1][3].