cve.bz

CVE-2019-3809

10.0 criticalEPSS 0.8%

Critical (10.0) in moodle moodle. EPSS 0.8% chance of exploitation in the next 30 days.

A flaw was found in Moodle versions 3.1 to 3.1.15 and earlier unsupported versions. The mybackpack functionality allowed setting the URL of badges, when it should be restricted to the Mozilla Open Badges backpack URL. This resulted in the possibility of blind SSRF via requests made by the page.

Severity

CVSS 3.0

10.0 critical
CVSS:3.0/AV:N/AC:L/PR:N/UI:N/S:C/C:H/I:H/A:H
EPSS
0.8% chance of exploitation in the next 30 days; higher than 57% of CVEs (scores of 2026-10-31)
CWEs
CWE-918, CWE-352
Published
Modified
Record from
the NVD, synced

Affected

References

Check your stackJSON