Moodle Private files uploaded via incoming mail processing could bypass quota restrictions

Also known as GHSA-j8wr-7xxj-c2fr

Published 7 y ago 2019-06-26 · modified 4 mo ago 2026-06-17 · JSON

CVSS

4.2

v3.0 · CNA

CISA KEV

not known exploited

EPSS

1.1%

percentile 64%

Public exploits

none known

A flaw was found in Moodle before 3.7, 3.6.4, 3.5.6, 3.4.9 and 3.1.18. The size of users' private file uploads via email were not correctly checked, so their quota allowance could be exceeded.

Exploit prediction (EPSS)

1.05% probability of exploitation in the next 30 days, higher than 64% of all scored CVEs.

CVSS scores

Assigned by	Version	Score	Vector
CNA	3.0	4.2	`CVSS:3.0/AV:N/AC:H/PR:L/UI:N/S:U/C:N/I:L/A:L`
NVD	3.1	3.7	`CVSS:3.1/AV:N/AC:H/PR:N/UI:N/S:U/C:N/I:L/A:N`
CNA	3.0	4.2	`CVSS:3.0/AV:N/AC:H/PR:L/UI:N/S:U/C:N/I:L/A:L`
NVD	2.0	4.3	`AV:N/AC:M/Au:N/C:N/I:P/A:N`
GitHub	3.0	4.2	`CVSS:3.0/AV:N/AC:H/PR:L/UI:N/S:U/C:N/I:L/A:L`

Affected packages

Ecosystem	Package	Affected	Fixed in
packagist	`moodle/moodle`	>=3.6, <3.6.4 >=3.5, <3.5.6 >=3.4, <3.4.9 >=3.1, <3.1.18	3.6.4 3.5.6 3.4.9 3.1.18

Affected products

Moodle moodle

Classification

Weakness

CWE-20 Improper Input Validation

References

bugzilla.redhat.com /show_bug.cgi?id=CVE-2019-10134 · x_refsource_CONFIRM, x_transferred
moodle.org /mod/forum/discuss.php?d=386524 · x_refsource_CONFIRM, x_transferred
nvd.nist.gov /vuln/detail/CVE-2019-10134 · advisory
github.com /moodle/moodle · package

Sources

CVE List: CVE-2019-10134
GitHub Advisory: GHSA-j8wr-7xxj-c2fr
NVD: CVE-2019-10134

vulnwire keeps one entry per vulnerability: the CVE id wins, then GHSA; records that alias each other are merged. Machine-readable: JSON.

Summary