VYPR
← All advisories
Medium severity4.3OSV Advisory· Published Mar 26, 2019· Updated Jun 17, 2026

CVE-2019-3848

CVE-2019-3848

Description

A vulnerability was found in moodle before versions 3.6.3, 3.5.5 and 3.4.8. Permissions were not correctly checked before loading event information into the calendar's edit event modal popup, so logged in non-guest users could view unauthorised calendar events. (Note: It was read-only access, users could not edit the events.)

AI Insight

LLM-synthesized narrative grounded in this CVE's description and references.

Affected packages

Versions sourced from the GitHub Security Advisory.

PackageAffected versionsPatched versions
moodle/moodlePackagist
>= 3.4, < 3.4.83.4.8
moodle/moodlePackagist
>= 3.5, < 3.5.53.5.5
moodle/moodlePackagist
>= 3.6, < 3.6.33.6.3

Affected products

3
  • Moodle/MoodleOSV2 versions
    v1.0.0, v1.0.1, v1.0.2, …+ 1 more
    • (no CPE)range: v1.0.0, v1.0.1, v1.0.2, …
    • cpe:2.3:a:moodle:moodle:*:*:*:*:*:*:*:*range: <3.4.8
  • ghsa-coords
    pkg:composer/moodle/moodle
    Range: >= 3.4, < 3.4.8

Patches

Vulnerability mechanics

References

4

News mentions

0

No linked articles in our index yet.