CVE-2019-14883

A vulnerability was found in Moodle 3.6 before 3.6.7 and 3.7 before 3.7.3, where tokens used to fetch inline atachments in email notifications were not disabled when a user's account was no longer active. Note: to access files, a user would need to know the file path, and their token.

Score

CVSS 3.1 5.3 Medium

Status

Modified - secalert@redhat.com

Published

2020-03-18

Last modified

2024-08-05

Weaknesses

CWE-285, CWE-862

Affected products

• Moodle (Moodle)
• Moodle (Unknown)

References

• https://bugzilla.redhat.com/show_bug.cgi?id=CVE-2019-14883
• https://moodle.org/mod/forum/discuss.php?d=393586#p1586750