Skip to content
OpenAdvisories
Medium USN-8805-1 1 CVE

moodle vulnerability

Published Sep 23, 2026 · Updated Sep 24, 2026

Ecosystem: Ubuntu

Summary

It was discovered that Moodle did not properly restrict URLs.
An authenticated user could possibly use this issue to perform a
server-side request forgery attack and expose sensitive information.

Fixed packages 2

ReleasePackageFixed in
Ubuntu · Pro 16.04 LTS Pro:16.04:LTS moodle 3.0.3+dfsg-0ubuntu1+esm1
Ubuntu · Pro 18.04 LTS Pro:18.04:LTS moodle 3.0.3+dfsg-0ubuntu1+esm1

Vulnerabilities 1

  • Medium 6.5
    CVE-2019-3809

    Moodle Blind SSRF Risk in /badges/mybackpack.php

    A flaw was found in Moodle versions 3.1 to 3.1.15 and earlier unsupported versions. The mybackpack functionality allowed setting the URL of badges, when it should be restricted to the Mozilla Open Badges backpack URL. This resulted in the possibility of blind…

    [UNKNOWN] moodle moodle/moodle moodle Web / CMS Ubuntu Packagist

References

  • report
    https://ubuntu.com/security/CVE-2019-3809