Search for vulnerabilities
Vulnerability details: VCID-q5cz-bbfa-kfc4
Vulnerability ID VCID-q5cz-bbfa-kfc4
Aliases CVE-2019-3848
GHSA-45rw-4r25-jvg7
Summary Moodle Logged in users could view all calendar events A vulnerability was found in moodle before versions 3.6.3, 3.5.5 and 3.4.8. Permissions were not correctly checked before loading event information into the calendar's edit event modal popup, so logged in non-guest users could view unauthorised calendar events. (Note: It was read-only access, users could not edit the events.)
Status Published
Exploitability 0.5
Weighted Severity 6.2
Risk 3.1
Affected and Fixed Packages Package Details
Weaknesses (4)
CWE-863 Incorrect Authorization
CWE-1035 OWASP Top Ten 2017 Category A9 - Using Components with Known Vulnerabilities
CWE-200 Exposure of Sensitive Information to an Unauthorized Actor
CWE-937 OWASP Top Ten 2013 Category A9 - Using Components with Known Vulnerabilities
System Score Found at
epss 0.00133 https://api.first.org/data/v1/epss?cve=CVE-2019-3848
epss 0.00133 https://api.first.org/data/v1/epss?cve=CVE-2019-3848
cvssv3.1 4.3 https://bugzilla.redhat.com/show_bug.cgi?id=CVE-2019-3848
generic_textual MODERATE https://bugzilla.redhat.com/show_bug.cgi?id=CVE-2019-3848
cvssv3.1_qr MODERATE https://github.com/advisories/GHSA-45rw-4r25-jvg7
cvssv3.1 4.3 https://github.com/moodle/moodle
generic_textual MODERATE https://github.com/moodle/moodle
cvssv3.1 4.3 https://moodle.org/mod/forum/discuss.php?d=384011#p1547743
generic_textual MODERATE https://moodle.org/mod/forum/discuss.php?d=384011#p1547743
cvssv2 4.0 https://nvd.nist.gov/vuln/detail/CVE-2019-3848
cvssv3.1 4.3 https://nvd.nist.gov/vuln/detail/CVE-2019-3848
generic_textual MODERATE https://nvd.nist.gov/vuln/detail/CVE-2019-3848
Reference id Reference type URL
https://api.first.org/data/v1/epss?cve=CVE-2019-3848
https://bugzilla.redhat.com/show_bug.cgi?id=CVE-2019-3848
https://github.com/moodle/moodle
https://moodle.org/mod/forum/discuss.php?d=384011#p1547743
https://nvd.nist.gov/vuln/detail/CVE-2019-3848
cpe:2.3:a:moodle:moodle:*:*:*:*:*:*:*:* https://nvd.nist.gov/vuln/search/results?adv_search=true&isCpeNameSearch=true&query=cpe:2.3:a:moodle:moodle:*:*:*:*:*:*:*:*
GHSA-45rw-4r25-jvg7 https://github.com/advisories/GHSA-45rw-4r25-jvg7
No exploits are available.
Vector: CVSS:3.1/AV:N/AC:L/PR:L/UI:N/S:U/C:L/I:N/A:N Found at https://bugzilla.redhat.com/show_bug.cgi?id=CVE-2019-3848
Attack Vector (AV) Attack Complexity (AC) Privileges Required (PR) User Interaction (UI) Scope (S) Confidentiality Impact (C) Integrity Impact (I) Availability Impact (A)

network

adjacent_network

local

physical

low

high

none

low

high

none

required

unchanged

changed

high

low

none

high

low

none

high

low

none
Vector: CVSS:3.1/AV:N/AC:L/PR:L/UI:N/S:U/C:L/I:N/A:N Found at https://github.com/moodle/moodle
Attack Vector (AV) Attack Complexity (AC) Privileges Required (PR) User Interaction (UI) Scope (S) Confidentiality Impact (C) Integrity Impact (I) Availability Impact (A)

network

adjacent_network

local

physical

low

high

none

low

high

none

required

unchanged

changed

high

low

none

high

low

none

high

low

none
Vector: CVSS:3.1/AV:N/AC:L/PR:L/UI:N/S:U/C:L/I:N/A:N Found at https://moodle.org/mod/forum/discuss.php?d=384011#p1547743
Attack Vector (AV) Attack Complexity (AC) Privileges Required (PR) User Interaction (UI) Scope (S) Confidentiality Impact (C) Integrity Impact (I) Availability Impact (A)

network

adjacent_network

local

physical

low

high

none

low

high

none

required

unchanged

changed

high

low

none

high

low

none

high

low

none
Vector: AV:N/AC:L/Au:S/C:P/I:N/A:N Found at https://nvd.nist.gov/vuln/detail/CVE-2019-3848
Exploitability (E) Access Vector (AV) Access Complexity (AC) Authentication (Au) Confidentiality Impact (C) Integrity Impact (I) Availability Impact (A)

high

functional

unproven

proof_of_concept

not_defined

local

adjacent_network

network

high

medium

low

multiple

single

none

none

partial

complete

none

partial

complete

none

partial

complete
Vector: CVSS:3.1/AV:N/AC:L/PR:L/UI:N/S:U/C:L/I:N/A:N Found at https://nvd.nist.gov/vuln/detail/CVE-2019-3848
Attack Vector (AV) Attack Complexity (AC) Privileges Required (PR) User Interaction (UI) Scope (S) Confidentiality Impact (C) Integrity Impact (I) Availability Impact (A)

network

adjacent_network

local

physical

low

high

none

low

high

none

required

unchanged

changed

high

low

none

high

low

none

high

low

none
Exploit Prediction Scoring System (EPSS)
Percentile 0.33926
EPSS Score 0.00133
Published At June 30, 2025, 12:55 p.m.
Date Actor Action Source VulnerableCode Version
2025-07-01T12:29:11.781439+00:00 GithubOSV Importer Import https://github.com/github/advisory-database/blob/main/advisories/github-reviewed/2022/05/GHSA-45rw-4r25-jvg7/GHSA-45rw-4r25-jvg7.json 36.1.3