Medium severity4.8OSV Advisory· Published Mar 27, 2019· Updated Jun 17, 2026
CVE-2019-3847
CVE-2019-3847
Description
A vulnerability was found in moodle before versions 3.6.3, 3.5.5, 3.4.8 and 3.1.17. Users with the "login as other users" capability (such as administrators/managers) can access other users' Dashboards, but the JavaScript those other users may have added to their Dashboard was not being escaped when being viewed by the user logging in on their behalf.
AI Insight
LLM-synthesized narrative grounded in this CVE's description and references.
Affected packages
Versions sourced from the GitHub Security Advisory.
| Package | Affected versions | Patched versions |
|---|---|---|
moodle/moodlePackagist | >= 3.6.0, < 3.6.3 | 3.6.3 |
moodle/moodlePackagist | >= 3.5.0, < 3.5.5 | 3.5.5 |
moodle/moodlePackagist | >= 3.2.0, < 3.4.8 | 3.4.8 |
moodle/moodlePackagist | < 3.1.17 | 3.1.17 |
Affected products
3Patches
Vulnerability mechanics
References
11- bugzilla.redhat.com/show_bug.cginvdIssue TrackingPatchThird Party AdvisoryWEB
- moodle.org/mod/forum/discuss.phpnvdPatchVendor AdvisoryWEB
- www.securityfocus.com/bid/107489nvdBroken LinkThird Party AdvisoryVDB Entry
- github.com/advisories/GHSA-qrcj-6fjw-3h9hghsaADVISORY
- nvd.nist.gov/vuln/detail/CVE-2019-3847ghsaADVISORY
- github.com/moodle/moodle/commit/070f24d006eab6b958eb083530de159b43c538edghsaWEB
- github.com/moodle/moodle/commit/93dda3bfd3caaaa8d23fe8ede543f27ef774958dghsaWEB
- github.com/moodle/moodle/commit/a37e26d2efe1ca0e4d8d69c611a748af35b33674ghsaWEB
- github.com/moodle/moodle/commit/e836242e1c04cd62d0afa4a790074fd245628e7aghsaWEB
- github.com/moodle/moodle/commit/ec3b63c772d6448765c68268234cf36c1a91bcacghsaWEB
- web.archive.org/web/20200227082922/http://www.securityfocus.com/bid/107489ghsaWEB
News mentions
0No linked articles in our index yet.