CVE-2019-10187

MediumCVSS 4.3/10Last modified Jun 17, 2026

Description

A flaw was found in moodle before versions 3.7.1, 3.6.5, 3.5.7. Users with permission to delete entries from a glossary were able to delete entries from other glossaries they did not have direct access to.

Metrics

CVSS 3.1 4.3/10CVSS:3.1/AV:N/AC:L/PR:L/UI:N/S:U/C:N/I:L/A:N

Weakness enumeration

CWE-284 CWE-862

Affected software

Vendor	Product	Versions
The Moodle Project	moodle	3.7.1; 3.6.5; 3.5.7

References

http://www.securityfocus.com/bid/109174Third Party Advisory, VDB Entry
https://bugzilla.redhat.com/show_bug.cgi?id=CVE-2019-10187Issue Tracking, Third Party Advisory
https://moodle.org/mod/forum/discuss.php?d=388568#p1566330Patch, Vendor Advisory
http://www.securityfocus.com/bid/109174Third Party Advisory, VDB Entry
https://bugzilla.redhat.com/show_bug.cgi?id=CVE-2019-10187Issue Tracking, Third Party Advisory
https://moodle.org/mod/forum/discuss.php?d=388568#p1566330Patch, Vendor Advisory

Timeline

Published: Jul 31, 2019
Last modified: Jun 17, 2026
NVD status: Modified

Related CVEs from 2019

CVE-2019-101884.3A flaw was found in moodle before versions 3.7.1, 3.6.5, 3.5.7. Teachers in a quiz group could modify group overrides for other groups in th CVE-2019-101894.3A flaw was found in moodle before versions 3.7.1, 3.6.5, 3.5.7. Teachers in an assignment group could modify group overrides for other group CVE-2019-10198.5A security feature bypass vulnerability exists where a NETLOGON message is able to obtain the session key and sign messages. To exploit this CVE-2019-101907.5A vulnerability was discovered in DNS resolver component of knot resolver through version 3.2.0 before 4.1.0 which allows remote attackers t CVE-2019-101917.5A vulnerability was discovered in DNS resolver of knot resolver before version 4.1.0 which allows remote attackers to downgrade DNSSEC-secur CVE-2019-101927.2A heap-buffer overflow vulnerability was found in the Redis hyperloglog data structure versions 3.x before 3.2.13, 4.x before 4.0.14 and 5.x CVE-2019-101937.2A stack-buffer overflow vulnerability was found in the Redis hyperloglog data structure versions 3.x before 3.2.13, 4.x before 4.0.14 and 5.CVE-2019-101945.5Sensitive passwords used in deployment and configuration of oVirt Metrics, all versions. were found to be insufficiently protected. Password CVE-2019-101956.5A flaw was found in IPA, all 4.6.x versions before 4.6.7, all 4.7.x versions before 4.7.4 and all 4.8.x versions before 4.8.3, in the way th CVE-2019-101969.8A flaw was found in http-proxy-agent, prior to version 2.1.0. It was discovered http-proxy-agent passes an auth option to the Buffer constru CVE-2019-101979.1A flaw was found in samba versions 4.9.x up to 4.9.13, samba 4.10.x up to 4.10.8 and samba 4.11.x up to 4.11.0rc3, when certain parameters w CVE-2019-101986.5An authentication bypass vulnerability was discovered in foreman-tasks before 0.15.7. Previously, commit tasks were searched through find_re