First day on Intigriti: our agent harness found and proved a remote code execution bug in Odoo's program.

CVE-2019-3851

MediumCVSS 4.3/10Last modified Jun 17, 2026

Description

A vulnerability was found in moodle before versions 3.6.3 and 3.5.5. There was a link to site home within the the Boost theme's secure layout, meaning students could navigate out of the page.

Metrics

CVSS 3.0 4.3/10CVSS:3.0/AV:N/AC:L/PR:L/UI:N/S:U/C:N/I:L/A:N

Affected software

Vendor	Product	Versions
[UNKNOWN]	moodle	3.6.3; 3.5.5

References

https://bugzilla.redhat.com/show_bug.cgi?id=CVE-2019-3851Issue Tracking, Patch, Third Party Advisory
https://moodle.org/mod/forum/discuss.php?d=384014#p1547746Patch, Vendor Advisory
https://bugzilla.redhat.com/show_bug.cgi?id=CVE-2019-3851Issue Tracking, Patch, Third Party Advisory
https://moodle.org/mod/forum/discuss.php?d=384014#p1547746Patch, Vendor Advisory

Timeline

Published: Mar 26, 2019
Last modified: Jun 17, 2026
NVD status: Modified

Related CVEs from 2019

CVE-2019-38524.3A vulnerability was found in moodle before version 3.6.3. The get_with_capability_join and get_users_by_capability functions were not taking CVE-2019-38558.8An integer overflow flaw which could lead to an out of bounds write was discovered in libssh2 before 1.8.1 in the way packets are read from CVE-2019-38568.8An integer overflow flaw, which could lead to an out of bounds write, was discovered in libssh2 before 1.8.1 in the way keyboard prompt requ CVE-2019-38578.8An integer overflow flaw which could lead to an out of bounds write was discovered in libssh2 before 1.8.1 in the way SSH_MSG_CHANNEL_REQUES CVE-2019-38589.1An out of bounds read flaw was discovered in libssh2 before 1.8.1 when a specially crafted SFTP packet is received from the server. A remote CVE-2019-38599.1An out of bounds read flaw was discovered in libssh2 before 1.8.1 in the _libssh2_packet_require and _libssh2_packet_requirev functions. A r CVE-2019-38609.1An out of bounds read flaw was discovered in libssh2 before 1.8.1 in the way SFTP packets with empty payloads are parsed. A remote attacker CVE-2019-38619.1An out of bounds read flaw was discovered in libssh2 before 1.8.1 in the way SSH packets with a padding length value greater than the packet CVE-2019-38629.1An out of bounds read flaw was discovered in libssh2 before 1.8.1 in the way SSH_MSG_CHANNEL_REQUEST packets with an exit status message and CVE-2019-38638.8A flaw was found in libssh2 before 1.8.1 creating a vulnerability on the SSH client side. A server could send a multiple keyboard interactiv CVE-2019-38648.8A vulnerability was discovered in all quay-2 versions before quay-3.0.0, in the Quay web GUI where POST requests include a specific paramete CVE-2019-38656.1A vulnerability was found in quay-2, where a stored XSS vulnerability has been found in the super user function of quay. Attackers are able