CVE-2019-10186

HighCVSS 8.8/10Last modified Jun 17, 2026

Description

A flaw was found in moodle before versions 3.7.1, 3.6.5, 3.5.7. A sesskey (CSRF) token was not being utilised by the XML loading/unloading admin tool.

Metrics

CVSS 3.1 8.8/10CVSS:3.1/AV:N/AC:L/PR:N/UI:R/S:U/C:H/I:H/A:H

Weakness enumeration

CWE-352

Affected software

Vendor	Product	Versions
The Moodle Project	moodle	3.7.1; 3.6.5; 3.5.7

References

http://www.securityfocus.com/bid/109175Broken Link, Third Party Advisory, VDB Entry
https://bugzilla.redhat.com/show_bug.cgi?id=CVE-2019-10186Issue Tracking, Third Party Advisory
https://moodle.org/mod/forum/discuss.php?d=388567#p1566329Patch, Vendor Advisory
http://www.securityfocus.com/bid/109175Broken Link, Third Party Advisory, VDB Entry
https://bugzilla.redhat.com/show_bug.cgi?id=CVE-2019-10186Issue Tracking, Third Party Advisory
https://moodle.org/mod/forum/discuss.php?d=388567#p1566329Patch, Vendor Advisory

Timeline

Published: Jul 31, 2019
Last modified: Jun 17, 2026
NVD status: Modified

Related CVEs from 2019

CVE-2019-101874.3A flaw was found in moodle before versions 3.7.1, 3.6.5, 3.5.7. Users with permission to delete entries from a glossary were able to delete CVE-2019-101884.3A flaw was found in moodle before versions 3.7.1, 3.6.5, 3.5.7. Teachers in a quiz group could modify group overrides for other groups in th CVE-2019-101894.3A flaw was found in moodle before versions 3.7.1, 3.6.5, 3.5.7. Teachers in an assignment group could modify group overrides for other group CVE-2019-10198.5A security feature bypass vulnerability exists where a NETLOGON message is able to obtain the session key and sign messages. To exploit this CVE-2019-101907.5A vulnerability was discovered in DNS resolver component of knot resolver through version 3.2.0 before 4.1.0 which allows remote attackers t CVE-2019-101917.5A vulnerability was discovered in DNS resolver of knot resolver before version 4.1.0 which allows remote attackers to downgrade DNSSEC-secur CVE-2019-101927.2A heap-buffer overflow vulnerability was found in the Redis hyperloglog data structure versions 3.x before 3.2.13, 4.x before 4.0.14 and 5.x CVE-2019-101937.2A stack-buffer overflow vulnerability was found in the Redis hyperloglog data structure versions 3.x before 3.2.13, 4.x before 4.0.14 and 5.CVE-2019-101945.5Sensitive passwords used in deployment and configuration of oVirt Metrics, all versions. were found to be insufficiently protected. Password CVE-2019-101956.5A flaw was found in IPA, all 4.6.x versions before 4.6.7, all 4.7.x versions before 4.7.4 and all 4.8.x versions before 4.8.3, in the way th CVE-2019-101969.8A flaw was found in http-proxy-agent, prior to version 2.1.0. It was discovered http-proxy-agent passes an auth option to the Buffer constru CVE-2019-101979.1A flaw was found in samba versions 4.9.x up to 4.9.13, samba 4.10.x up to 4.10.8 and samba 4.11.x up to 4.11.0rc3, when certain parameters w