Cross-Site Request Forgery (CSRF)

2024-04-0319:05:45

Veracode Vulnerability Database

sca.analysiscenter.veracode.com

cross-site request forgery

csrf

moodle

vulnerability

language packs

csrf token

attacker

CVSS3

4.3

Attack Vector

NETWORK

Attack Complexity

LOW

Privileges Required

NONE

User Interaction

REQUIRED

Scope

UNCHANGED

Confidentiality Impact

LOW

Integrity Impact

NONE

Availability Impact

NONE

CVSS:3.1/AV:N/AC:L/PR:N/UI:R/S:U/C:L/I:N/A:N

AI Score

6.7

Confidence

High

EPSS

Percentile

15.5%

JSON

moodle/moodle is vulnerable to Cross-Site Request Forgery (CSRF). The vulnerability is due to the link to update all installed language packs not including a necessary CSRF token. An attacker can exploit this vulnerability by tricking a user into clicking on a crafted link or navigating to a malicious website.