{"action":"Upgrade moodle/moodle to 3.4.8 or later.","affected":[{"fixed":"3.4.8","introduced":"0"},{"fixed":"3.5.5","introduced":"3.5"},{"fixed":"3.6.3","introduced":"3.6"}],"component":"moodle/moodle","cve_ids":["CVE-2019-3849"],"ecosystem":"Packagist","epss":0.01023,"exploited":false,"fixed_versions":["3.4.8","3.5.5","3.6.3"],"ghsa_id":"GHSA-5wg9-5w3f-hxmh","id":"tcs_01M5KEWES71DH0MB4WMGCBNERW","modified_at":"2024-02-16T08:25:00.548328Z","published_at":"2022-05-13T01:14:32Z","references":["https://osv.dev/vulnerability/GHSA-5wg9-5w3f-hxmh","https://nvd.nist.gov/vuln/detail/CVE-2019-3849","https://github.com/moodle/moodle/commit/427463a52574e4b3bcbe1c65c49066438770641e","https://github.com/moodle/moodle/commit/430f685834cef190bdf58afabe79e765d596890d","https://github.com/moodle/moodle/commit/723d1a747555b795ed53a0fad01da455797bb78f","https://github.com/moodle/moodle/commit/898d5d05a0c3ae6795db0241bf3cb5951213d45c","https://github.com/moodle/moodle/commit/b77dcd23d8e39265b5c096f0d947764c02d832c8","https://github.com/moodle/moodle/commit/cd3060d941a051931eb2613b25bafb0108665895","https://github.com/moodle/moodle/commit/fba7dcd90abd45210d782a79c6e25bb3840c7438","https://bugzilla.redhat.com/show_bug.cgi?id=CVE-2019-3849","https://github.com/moodle/moodle","https://moodle.org/mod/forum/discuss.php?d=384012#p1547744"],"severity":{"label":"high","score":8.8},"sources":[{"source":"osv","source_id":"GHSA-5wg9-5w3f-hxmh","url":"https://osv.dev/vulnerability/GHSA-5wg9-5w3f-hxmh"}],"summary":"Moodle Users could elevate their role when accessing the LTI tool on a provider site"}