CSRF Token Bypass in Moodle XML Loading/Unloading Admin Tool
CVE-2019-10186 · HIGH Severity
CVSS:3.1/AV:N/AC:L/PR:N/UI:R/S:U/C:H/I:H/A:H
A flaw was found in moodle before versions 3.7.1, 3.6.5, 3.5.7. A sesskey (CSRF) token was not being utilised by the XML loading/unloading admin tool.
Learn more about our Web Application Penetration Testing UK.