CVE-2019-10188 moodle Improper Access Control

Medium 4.0 Published 31 Jul 2019 Updated 4 Aug 2024

Teachers can improperly modify quiz group overrides for other groups, allowing unauthorized data modification within the Moodle learning platform.

Exploited in the wild: Not known
Login needed: Not needed
Attackable: Local or same network only
Victim action needed: Not needed
Fix: Available

What is CVE-2019-10188?

CVE-2019-10188 is a medium-severity missing authorization vulnerability in Moodle Moodle, published on 31 Jul 2019. It can only be exploited from the same machine or local network, with no action from the victim.

Official description

A flaw was found in moodle before versions 3.7.1, 3.6.5, 3.5.7. Teachers in a quiz group could modify group overrides for other groups in the same quiz.

Weakness: CWE-284

Which versions are affected by CVE-2019-10188?

6 open source packages ship an affected version, including moodle/moodle. It affects 1 product.

Package	Affected	Fixed in
`moodle/moodle` Packagist	All versions	`3.5.7`
`moodle/moodle` Packagist	All versions	`3.5.7`
`moodle/moodle` Packagist	From `3.6.0`	`3.6.5`
`moodle/moodle` Packagist	From `3.6.0`	`3.6.5`
`moodle/moodle` Packagist	From `3.7.0`	`3.7.1`
`moodle/moodle` Packagist	From `3.7.0`	`3.7.1`

Products include Moodle Moodle.

How do I fix CVE-2019-10188?

Upgrade moodle/moodle to a fixed version for your release line: 3.5.7, 3.6.5 or 3.7.1.

Upgrade, and check permissions on every request on the server, not only in the interface. More about Missing authorization.

Is CVE-2019-10188 being exploited?

There is no known exploitation of CVE-2019-10188 in the wild and no public exploit code.

All Moodle Moodle vulnerabilities

Sources

Also known as GHSA-92q5-2h76-vgmj, UBUNTU-CVE-2019-10188.