NetSight
IP …
medium6.5

CVE-2018-16854

A flaw was found in moodle versions 3.5 to 3.5.2, 3.4 to 3.4.5, 3.3 to 3.3.8, 3.1 to 3.1.14 and earlier.

Impact

A flaw was found in moodle versions 3.5 to 3.5.2, 3.4 to 3.4.5, 3.3 to 3.3.8, 3.1 to 3.1.14 and earlier. The login form is not protected by a token to prevent login cross-site request forgery. Fixed versions include 3.6, 3.5.3, 3.4.6, 3.3.9 and 3.1.15.

Affected products

VendorProductAffected versions
MoodleMoodle
through 3.0.10
from 3.1.0 before 3.1.15
from 3.3.0 before 3.3.9
from 3.4.0 before 3.4.6
from 3.5.0 before 3.5.3

Weakness classification

CWE-352

References