# CVSS v3.0: Medium Severity CVEs whose CVSS v3.0 severity is MEDIUM. Source: https://docs.deepinfo.com/reference/vulnerability/search/examples/metrics-cvss-metric-v30-cvss-data-base-severity/ Last updated: 2026-09-26 --- `POST https://api.deepinfo.com/v1/discovery/vulnerability-search?page_size=25` CVEs whose CVSS v3.0 severity is MEDIUM. Example 14 of 16 in **Filters › CVSS v3.0** · [Vulnerability Search Examples](/reference/vulnerability/search/examples/) · endpoint: [Search](/reference/vulnerability/search/) Tags: `field` `metrics.cvss_metric_v30.cvss_data.base_severity` · `operator` `eq` `metrics.cvss_metric_v30.cvss_data.base_severity` is the severity band of the base score, in the CVSS v3.0 metric (`metrics.cvss_metric_v30`, one entry per scoring source). `eq` matches the exact value `MEDIUM`. In the response, look at `results[].metrics.cvss_metric_v30[].cvss_data.base_severity`. ## Request | Parameter | In | Value | |---|---|---| | `page_size` | query | `25` | | `filters.must[0].name` | body | `metrics.cvss_metric_v30.cvss_data.base_severity` | | `filters.must[0].type` | body | `eq` | | `filters.must[0].value` | body | `MEDIUM` | ```bash curl -X POST 'https://api.deepinfo.com/v1/discovery/vulnerability-search?page_size=25' \ -H 'apikey: YOUR_API_KEY' \ -H 'Accept: application/json' \ -H 'Content-Type: application/json' \ -d '{ "filters": { "must": [ { "name": "metrics.cvss_metric_v30.cvss_data.base_severity", "type": "eq", "value": "MEDIUM" } ] } }' ``` ## Response ### 200 · OK > Shortened for this page: results: 3 of 25 shown; results[].enrichment.cwe[].capec_id: first 10 items `Content-Type: application/json` · `ratelimit-limit: 1` · `ratelimit-remaining: 0` · `ratelimit-reset: 1` · `x-ratelimit-limit-second: 1` · `x-ratelimit-remaining-second: 0` · `deepinfo-request-id: 5f0c6a8e-1b2d-4c3e-9f4a-7b8c9d0e1f2a` ```json { "page": 1, "page_size": 25, "result_count": 21435, "results": [ { "id": "CVE-2026-21636", "source_identifier": "support@hackerone.com", "published": "2026-01-20T21:16:05Z", "last_modified": "2026-06-17T10:18:51Z", "status": "Analyzed", "evaluator_comment": null, "evaluator_solution": null, "evaluator_impact": null, "cisa_exploit_add": null, "cisa_action_due": null, "cisa_required_action": null, "cisa_vulnerability_name": null, "descriptions": [ { "lang": "en", "value": "A flaw in Node.js's permission model allows Unix Domain Socket (UDS) connections to bypass network restrictions when `--permission` is enabled. Even without `--allow-net`, attacker-controlled inputs (such as URLs or socketPath options) can connect to arbitrary local sockets via net, tls, or undici/fetch. This breaks the intended security boundary of the permission model and enables access to privileged local services, potentially leading to privilege escalation, data exposure, or local code execution.\n\n* The issue affects users of the Node.js permission model on version v25.\n\nIn the moment of this vulnerability, network permissions (`--allow-net`) are still in the experimental phase." }, { "lang": "es", "value": "Una falla en el modelo de permisos de Node.js permite que las conexiones de Unix Domain Socket (UDS) eludan las restricciones de red cuando '--permission' está habilitado. Incluso sin '--allow-net', las entradas controladas por el atacante (como URLs u opciones de socketPath) pueden conectarse a sockets locales arbitrarios a través de net, tls o undici/fetch. Esto rompe el límite de seguridad previsto del modelo de permisos y permite el acceso a servicios locales privilegiados, lo que podría llevar a escalada de privilegios, exposición de datos o ejecución de código local.\n\n* El problema afecta a los usuarios del modelo de permisos de Node.js en la versión v25.\n\nEn el momento de esta vulnerabilidad, los permisos de red ('--allow-net') todavía están en fase experimental." } ], "references": [ { "url": "https://nodejs.org/en/blog/vulnerability/december-2025-security-releases", "source": "support@hackerone.com", "tags": [ "Release Notes", "Vendor Advisory" ] } ], "metrics": { "cvss_metric_v40": null, "cvss_metric_v31": [ { "source": "user@nist.gov", "type": "Primary", "cvss_data": { "version": "3.1", "vector_string": "CVSS:3.1/AV:N/AC:L/PR:N/UI:N/S:C/C:H/I:H/A:H", "attack_vector": "NETWORK", "attack_complexity": "LOW", "privileges_required": "NONE", "user_interaction": "NONE", "scope": "CHANGED", "confidentiality_impact": "HIGH", "integrity_impact": "HIGH", "availability_impact": "HIGH", "base_score": 10.0, "base_severity": "CRITICAL", "exploit_code_maturity": null, "remediation_level": null, "report_confidence": null, "temporal_score": null, "temporal_severity": null, "confidentiality_requirement": null, "integrity_requirement": null, "availability_requirement": null, "modified_attack_vector": null, "modified_attack_complexity": null, "modified_privileges_required": null, "modified_user_interaction": null, "modified_scope": null, "modified_confidentiality_impact": null, "modified_integrity_impact": null, "modified_availability_impact": null, "environmental_score": null, "environmental_severity": null }, "exploitability_score": 3.9, "impact_score": 6.0 } ], "cvss_metric_v30": [ { "source": "support@hackerone.com", "type": "Secondary", "cvss_data": { "version": "3.0", "vector_string": "CVSS:3.0/AV:N/AC:L/PR:N/UI:N/S:C/C:L/I:N/A:N", "attack_vector": "NETWORK", "attack_complexity": "LOW", "privileges_required": "NONE", "user_interaction": "NONE", "scope": "CHANGED", "confidentiality_impact": "LOW", "integrity_impact": "NONE", "availability_impact": "NONE", "base_score": 5.8, "base_severity": "MEDIUM", "exploit_code_maturity": null, "remediation_level": null, "report_confidence": null, "temporal_score": null, "temporal_severity": null, "confidentiality_requirement": null, "integrity_requirement": null, "availability_requirement": null, "modified_attack_vector": null, "modified_attack_complexity": null, "modified_privileges_required": null, "modified_user_interaction": null, "modified_scope": null, "modified_confidentiality_impact": null, "modified_integrity_impact": null, "modified_availability_impact": null, "environmental_score": null, "environmental_severity": null }, "exploitability_score": 3.9, "impact_score": 1.4 } ], "cvss_metric_v2": null }, "weaknesses": [ { "source": "134c704f-9b21-4f2e-91b3-4a467353bcc0", "type": "Secondary", "description": [ { "lang": "en", "value": "CWE-284" } ] } ], "configurations": [ { "operator": null, "negate": null, "nodes": [ { "operator": "OR", "negate": false, "cpe_match": [ { "vulnerable": true, "criteria": "cpe:2.3:a:nodejs:node.js:*:*:*:*:-:*:*:*", "match_criteria_id": "970EF154-D905-4FDA-85CB-C3AB08BEFAEC", "version_start_including": "25.0.0", "version_start_excluding": null, "version_end_including": null, "version_end_excluding": "25.3.0" } ] } ] } ], "vendor_comments": null, "enrichment": { "cpe": [ { "criteria": "cpe:2.3:a:nodejs:node.js:*:*:*:*:-:*:*:*", "vendor": "nodejs", "product": "node.js", "product_type": "a", "vulnerable": true, "version_start_including": "25.0.0", "version_start_excluding": null, "version_end_including": null, "version_end_excluding": "25.3.0", "affected_versions_first": null, "affected_versions_last": null } ], "cwe": [ { "id": 284, "owasptop10_2021": "A01 Broken Access Control", "name": "Improper Access Control", "description": "The product does not restrict or incorrectly restricts access to a resource from an unauthorized actor.", "capec_id": [ 19, 441, 478, 479, 502, 503, 536, 546, 550, 551 ], "scope": [ "Other" ], "impact": [ "Varies by Context" ], "detection_method": null } ], "epss_score": { "epss": 0.00883, "percentile": 0.57681, "date": "2026-09-23" }, "cisa_kev": null, "vdeep_metric": { "available_versions": [ "3.1", "3.0" ], "source": "user@nist.gov", "type": "Primary", "cvss_data": { "version": "3.1", "vector_string": "CVSS:3.1/AV:N/AC:L/PR:N/UI:N/S:C/C:H/I:H/A:H", "attack_vector": "NETWORK", "attack_complexity": "LOW", "attack_requirements": null, "privileges_required": "NONE", "user_interaction": "NONE", "vulnerable_system_confidentiality": "HIGH", "vulnerable_system_integrity": "HIGH", "vulnerable_system_availability": "HIGH", "subsequent_system_confidentiality": null, "subsequent_system_integrity": null, "subsequent_system_availability": null, "exploit_maturity": null, "confidentiality_requirements": null, "integrity_requirements": null, "availability_requirements": null, "modified_attack_vector": null, "modified_attack_complexity": null, "modified_attack_requirements": null, "modified_privileges_required": null, "modified_user_interaction": null, "modified_vulnerable_system_confidentiality": null, "modified_vulnerable_system_integrity": null, "modified_vulnerable_system_availability": null, "modified_subsequent_system_confidentiality": null, "modified_subsequent_system_integrity": null, "modified_subsequent_system_availability": null, "safety": null, "automatable": null, "recovery": null, "value_density": null, "vulnerability_response_effort": null, "provider_urgency": null, "base_score": 10.0, "base_severity": "CRITICAL" } } } }, { "id": "CVE-2019-9901", "source_identifier": "user@mitre.org", "published": "2019-04-25T16:29:01Z", "last_modified": "2026-06-17T02:44:49Z", "status": "Modified", "evaluator_comment": null, "evaluator_solution": null, "evaluator_impact": null, "cisa_exploit_add": null, "cisa_action_due": null, "cisa_required_action": null, "cisa_vulnerability_name": null, "descriptions": [ { "lang": "en", "value": "Envoy 1.9.0 and before does not normalize HTTP URL paths. A remote attacker may craft a relative path, e.g., something/../admin, to bypass access control, e.g., a block on /admin. A backend server could then interpret the non-normalized path and provide an attacker access beyond the scope provided for by the access control policy." }, { "lang": "es", "value": "Envoy versión 1.9.0 y anteriores no normalizan las path URL HTTP. Un atacante remoto puede crear un path relativo, por ejemplo, algo/.. /admin, para omitir el control de acceso, por ejemplo, un bloque en/admin. A continuación, un servidor back-end podría interpretar el path no normalizado y suministrar a un atacante acceso más allá del ámbito suministrado por la Directiva de control de acceso." } ], "references": [ { "url": "https://github.com/envoyproxy/envoy/issues/6435", "source": "user@mitre.org", "tags": [ "Issue Tracking", "Mitigation", "Third Party Advisory" ] }, { "url": "https://github.com/envoyproxy/envoy/security/advisories/GHSA-xcx5-93pw-jw2w", "source": "user@mitre.org", "tags": null }, { "url": "https://groups.google.com/forum/#%21topic/envoy-announce/VoHfnDqZiAM", "source": "user@mitre.org", "tags": null }, { "url": "https://www.envoyproxy.io/docs/envoy/v1.9.1/intro/version_history", "source": "user@mitre.org", "tags": [ "Release Notes", "Vendor Advisory" ] }, { "url": "https://github.com/envoyproxy/envoy/issues/6435", "source": "af854a3a-2127-422b-91ae-364da2661108", "tags": [ "Issue Tracking", "Mitigation", "Third Party Advisory" ] }, { "url": "https://github.com/envoyproxy/envoy/security/advisories/GHSA-xcx5-93pw-jw2w", "source": "af854a3a-2127-422b-91ae-364da2661108", "tags": null }, { "url": "https://groups.google.com/forum/#%21topic/envoy-announce/VoHfnDqZiAM", "source": "af854a3a-2127-422b-91ae-364da2661108", "tags": null }, { "url": "https://www.envoyproxy.io/docs/envoy/v1.9.1/intro/version_history", "source": "af854a3a-2127-422b-91ae-364da2661108", "tags": [ "Release Notes", "Vendor Advisory" ] } ], "metrics": { "cvss_metric_v40": null, "cvss_metric_v31": null, "cvss_metric_v30": [ { "source": "user@mitre.org", "type": "Secondary", "cvss_data": { "version": "3.0", "vector_string": "CVSS:3.0/AV:N/AC:H/PR:N/UI:N/S:C/C:L/I:L/A:L", "attack_vector": "NETWORK", "attack_complexity": "HIGH", "privileges_required": "NONE", "user_interaction": "NONE", "scope": "CHANGED", "confidentiality_impact": "LOW", "integrity_impact": "LOW", "availability_impact": "LOW", "base_score": 6.5, "base_severity": "MEDIUM", "exploit_code_maturity": null, "remediation_level": null, "report_confidence": null, "temporal_score": null, "temporal_severity": null, "confidentiality_requirement": null, "integrity_requirement": null, "availability_requirement": null, "modified_attack_vector": null, "modified_attack_complexity": null, "modified_privileges_required": null, "modified_user_interaction": null, "modified_scope": null, "modified_confidentiality_impact": null, "modified_integrity_impact": null, "modified_availability_impact": null, "environmental_score": null, "environmental_severity": null }, "exploitability_score": 2.2, "impact_score": 3.7 }, { "source": "user@nist.gov", "type": "Primary", "cvss_data": { "version": "3.0", "vector_string": "CVSS:3.0/AV:N/AC:L/PR:N/UI:N/S:C/C:H/I:H/A:H", "attack_vector": "NETWORK", "attack_complexity": "LOW", "privileges_required": "NONE", "user_interaction": "NONE", "scope": "CHANGED", "confidentiality_impact": "HIGH", "integrity_impact": "HIGH", "availability_impact": "HIGH", "base_score": 10.0, "base_severity": "CRITICAL", "exploit_code_maturity": null, "remediation_level": null, "report_confidence": null, "temporal_score": null, "temporal_severity": null, "confidentiality_requirement": null, "integrity_requirement": null, "availability_requirement": null, "modified_attack_vector": null, "modified_attack_complexity": null, "modified_privileges_required": null, "modified_user_interaction": null, "modified_scope": null, "modified_confidentiality_impact": null, "modified_integrity_impact": null, "modified_availability_impact": null, "environmental_score": null, "environmental_severity": null }, "exploitability_score": 3.9, "impact_score": 6.0 } ], "cvss_metric_v2": [ { "source": "user@nist.gov", "type": "Primary", "cvss_data": { "version": "2.0", "vector_string": "AV:N/AC:L/Au:N/C:P/I:P/A:P", "access_vector": "NETWORK", "access_complexity": "LOW", "authentication": "NONE", "confidentiality_impact": "PARTIAL", "integrity_impact": "PARTIAL", "availability_impact": "PARTIAL", "base_score": 7.5, "exploitability": null, "remediation_level": null, "report_confidence": null, "temporal_score": null, "collateral_damage_potential": null, "target_distribution": null, "confidentiality_requirement": null, "integrity_requirement": null, "availability_requirement": null, "environmental_score": null }, "base_severity": "HIGH", "exploitability_score": 10.0, "impact_score": 6.4, "ac_insuf_info": false, "obtain_all_privilege": false, "obtain_user_privilege": false, "obtain_other_privilege": false, "user_interaction_required": false } ] }, "weaknesses": [ { "source": "user@nist.gov", "type": "Primary", "description": [ { "lang": "en", "value": "CWE-706" } ] } ], "configurations": [ { "operator": null, "negate": null, "nodes": [ { "operator": "OR", "negate": false, "cpe_match": [ { "vulnerable": true, "criteria": "cpe:2.3:a:envoyproxy:envoy:*:*:*:*:*:*:*:*", "match_criteria_id": "BF47B6A7-F357-4074-B90D-8BEB0AB53DC0", "version_start_including": null, "version_start_excluding": null, "version_end_including": "1.9.0", "version_end_excluding": null } ] } ] } ], "vendor_comments": null, "enrichment": { "cpe": [ { "criteria": "cpe:2.3:a:envoyproxy:envoy:*:*:*:*:*:*:*:*", "vendor": "envoyproxy", "product": "envoy", "product_type": "a", "vulnerable": true, "version_start_including": null, "version_start_excluding": null, "version_end_including": "1.9.0", "version_end_excluding": null, "affected_versions_first": "1.0.0", "affected_versions_last": "1.9.0" } ], "cwe": [ { "id": 706, "owasptop10_2021": "A01 Broken Access Control", "name": "Use of Incorrectly-Resolved Name or Reference", "description": "The product uses a name or reference to access a resource, but the name/reference resolves to a resource that is outside of the intended control sphere.", "capec_id": [ 48, 159, 177, 641 ], "scope": [ "Confidentiality", "Integrity" ], "impact": [ "Modify Application Data", "Read Application Data" ], "detection_method": [ "Automated Static Analysis" ] } ], "epss_score": { "epss": 0.04951, "percentile": 0.91786, "date": "2026-09-23" }, "cisa_kev": null, "vdeep_metric": { "available_versions": [ "3.0", "2.0" ], "source": "user@nist.gov", "type": "Primary", "cvss_data": { "version": "3.0", "vector_string": "CVSS:3.0/AV:N/AC:L/PR:N/UI:N/S:C/C:H/I:H/A:H", "attack_vector": "NETWORK", "attack_complexity": "LOW", "attack_requirements": null, "privileges_required": "NONE", "user_interaction": "NONE", "vulnerable_system_confidentiality": "HIGH", "vulnerable_system_integrity": "HIGH", "vulnerable_system_availability": "HIGH", "subsequent_system_confidentiality": null, "subsequent_system_integrity": null, "subsequent_system_availability": null, "exploit_maturity": null, "confidentiality_requirements": null, "integrity_requirements": null, "availability_requirements": null, "modified_attack_vector": null, "modified_attack_complexity": null, "modified_attack_requirements": null, "modified_privileges_required": null, "modified_user_interaction": null, "modified_vulnerable_system_confidentiality": null, "modified_vulnerable_system_integrity": null, "modified_vulnerable_system_availability": null, "modified_subsequent_system_confidentiality": null, "modified_subsequent_system_integrity": null, "modified_subsequent_system_availability": null, "safety": null, "automatable": null, "recovery": null, "value_density": null, "vulnerability_response_effort": null, "provider_urgency": null, "base_score": 10.0, "base_severity": "CRITICAL" } } } }, { "id": "CVE-2019-3809", "source_identifier": "user@redhat.com", "published": "2019-03-25T18:29:00Z", "last_modified": "2026-06-17T02:35:38Z", "status": "Modified", "evaluator_comment": null, "evaluator_solution": null, "evaluator_impact": null, "cisa_exploit_add": null, "cisa_action_due": null, "cisa_required_action": null, "cisa_vulnerability_name": null, "descriptions": [ { "lang": "en", "value": "A flaw was found in Moodle versions 3.1 to 3.1.15 and earlier unsupported versions. The mybackpack functionality allowed setting the URL of badges, when it should be restricted to the Mozilla Open Badges backpack URL. This resulted in the possibility of blind SSRF via requests made by the page." }, { "lang": "es", "value": "Se ha encontrado un error en Moodle, en versiones 3.1 a 3.1.15 y versiones anteriores sin soporte. La funcionalidad ‘‘mybackpack’’ ha permitido establecer la URL de las insignias cuando debería estar restringida la URL del ‘‘backpack’’ de Mozilla Open Badges. Esto ha resultado en la posibilidad de un ataque ciego de SSRF a través de peticiones hechas por la página." } ], "references": [ { "url": "http://git.moodle.org/gw?p=moodle.git&a=search&h=HEAD&st=commit&s=MDL-64222", "source": "user@redhat.com", "tags": [ "Patch", "Vendor Advisory" ] }, { "url": "https://bugzilla.redhat.com/show_bug.cgi?id=CVE-2019-3809", "source": "user@redhat.com", "tags": [ "Issue Tracking", "Patch", "Third Party Advisory" ] }, { "url": "https://moodle.org/mod/forum/discuss.php?d=381229#p1536766", "source": "user@redhat.com", "tags": [ "Patch", "Vendor Advisory" ] }, { "url": "http://git.moodle.org/gw?p=moodle.git&a=search&h=HEAD&st=commit&s=MDL-64222", "source": "af854a3a-2127-422b-91ae-364da2661108", "tags": [ "Patch", "Vendor Advisory" ] }, { "url": "https://bugzilla.redhat.com/show_bug.cgi?id=CVE-2019-3809", "source": "af854a3a-2127-422b-91ae-364da2661108", "tags": [ "Issue Tracking", "Patch", "Third Party Advisory" ] }, { "url": "https://moodle.org/mod/forum/discuss.php?d=381229#p1536766", "source": "af854a3a-2127-422b-91ae-364da2661108", "tags": [ "Patch", "Vendor Advisory" ] } ], "metrics": { "cvss_metric_v40": null, "cvss_metric_v31": null, "cvss_metric_v30": [ { "source": "user@redhat.com", "type": "Secondary", "cvss_data": { "version": "3.0", "vector_string": "CVSS:3.0/AV:N/AC:L/PR:N/UI:N/S:U/C:N/I:L/A:L", "attack_vector": "NETWORK", "attack_complexity": "LOW", "privileges_required": "NONE", "user_interaction": "NONE", "scope": "UNCHANGED", "confidentiality_impact": "NONE", "integrity_impact": "LOW", "availability_impact": "LOW", "base_score": 6.5, "base_severity": "MEDIUM", "exploit_code_maturity": null, "remediation_level": null, "report_confidence": null, "temporal_score": null, "temporal_severity": null, "confidentiality_requirement": null, "integrity_requirement": null, "availability_requirement": null, "modified_attack_vector": null, "modified_attack_complexity": null, "modified_privileges_required": null, "modified_user_interaction": null, "modified_scope": null, "modified_confidentiality_impact": null, "modified_integrity_impact": null, "modified_availability_impact": null, "environmental_score": null, "environmental_severity": null }, "exploitability_score": 3.9, "impact_score": 2.5 }, { "source": "user@nist.gov", "type": "Primary", "cvss_data": { "version": "3.0", "vector_string": "CVSS:3.0/AV:N/AC:L/PR:N/UI:N/S:C/C:H/I:H/A:H", "attack_vector": "NETWORK", "attack_complexity": "LOW", "privileges_required": "NONE", "user_interaction": "NONE", "scope": "CHANGED", "confidentiality_impact": "HIGH", "integrity_impact": "HIGH", "availability_impact": "HIGH", "base_score": 10.0, "base_severity": "CRITICAL", "exploit_code_maturity": null, "remediation_level": null, "report_confidence": null, "temporal_score": null, "temporal_severity": null, "confidentiality_requirement": null, "integrity_requirement": null, "availability_requirement": null, "modified_attack_vector": null, "modified_attack_complexity": null, "modified_privileges_required": null, "modified_user_interaction": null, "modified_scope": null, "modified_confidentiality_impact": null, "modified_integrity_impact": null, "modified_availability_impact": null, "environmental_score": null, "environmental_severity": null }, "exploitability_score": 3.9, "impact_score": 6.0 } ], "cvss_metric_v2": [ { "source": "user@nist.gov", "type": "Primary", "cvss_data": { "version": "2.0", "vector_string": "AV:N/AC:L/Au:N/C:P/I:P/A:P", "access_vector": "NETWORK", "access_complexity": "LOW", "authentication": "NONE", "confidentiality_impact": "PARTIAL", "integrity_impact": "PARTIAL", "availability_impact": "PARTIAL", "base_score": 7.5, "exploitability": null, "remediation_level": null, "report_confidence": null, "temporal_score": null, "collateral_damage_potential": null, "target_distribution": null, "confidentiality_requirement": null, "integrity_requirement": null, "availability_requirement": null, "environmental_score": null }, "base_severity": "HIGH", "exploitability_score": 10.0, "impact_score": 6.4, "ac_insuf_info": false, "obtain_all_privilege": false, "obtain_user_privilege": false, "obtain_other_privilege": false, "user_interaction_required": false } ] }, "weaknesses": [ { "source": "user@redhat.com", "type": "Secondary", "description": [ { "lang": "en", "value": "CWE-352" } ] }, { "source": "user@nist.gov", "type": "Primary", "description": [ { "lang": "en", "value": "CWE-918" } ] } ], "configurations": [ { "operator": null, "negate": null, "nodes": [ { "operator": "OR", "negate": false, "cpe_match": [ { "vulnerable": true, "criteria": "cpe:2.3:a:moodle:moodle:*:*:*:*:*:*:*:*", "match_criteria_id": "979D2B8B-FB1F-4802-AAFC-13715A82293F", "version_start_including": "3.1.0", "version_start_excluding": null, "version_end_including": "3.1.15", "version_end_excluding": null } ] } ] } ], "vendor_comments": null, "enrichment": { "cpe": [ { "criteria": "cpe:2.3:a:moodle:moodle:*:*:*:*:*:*:*:*", "vendor": "moodle", "product": "moodle", "product_type": "a", "vulnerable": true, "version_start_including": "3.1.0", "version_start_excluding": null, "version_end_including": "3.1.15", "version_end_excluding": null, "affected_versions_first": "3.1.0", "affected_versions_last": "3.1.15" } ], "cwe": [ { "id": 352, "owasptop10_2021": "A01 Broken Access Control", "name": "Cross-Site Request Forgery (CSRF)", "description": "The web application does not, or cannot, sufficiently verify whether a request was intentionally provided by the user who sent the request, which could have originated from an unauthorized actor. ", "capec_id": [ 62, 111, 462, 467 ], "scope": [ "Access Control", "Availability", "Confidentiality", "Integrity", "Non-Repudiation" ], "impact": [ "Bypass Protection Mechanism", "DoS: Crash, Exit, or Restart", "Gain Privileges or Assume Identity", "Modify Application Data", "Read Application Data" ], "detection_method": [ "Architecture or Design Review", "Automated Static Analysis", "Automated Static Analysis - Binary or Bytecode", "Automated Static Analysis - Source Code", "Dynamic Analysis with Automated Results Interpretation", "Dynamic Analysis with Manual Results Interpretation", "Manual Analysis", "Manual Static Analysis - Binary or Bytecode", "Manual Static Analysis - Source Code" ] }, { "id": 918, "owasptop10_2021": "A10 Server-Side Request Forgery (SSRF)", "name": "Server-Side Request Forgery (SSRF)", "description": "The web server receives a URL or similar request from an upstream component and retrieves the contents of this URL, but it does not sufficiently ensure that the request is being sent to the expected destination.", "capec_id": [ 664 ], "scope": [ "Access Control", "Confidentiality", "Integrity" ], "impact": [ "Bypass Protection Mechanism", "Execute Unauthorized Code or Commands", "Read Application Data" ], "detection_method": [ "Automated Static Analysis" ] } ], "epss_score": { "epss": 0.00861, "percentile": 0.57025, "date": "2026-09-23" }, "cisa_kev": null, "vdeep_metric": { "available_versions": [ "3.0", "2.0" ], "source": "user@nist.gov", "type": "Primary", "cvss_data": { "version": "3.0", "vector_string": "CVSS:3.0/AV:N/AC:L/PR:N/UI:N/S:C/C:H/I:H/A:H", "attack_vector": "NETWORK", "attack_complexity": "LOW", "attack_requirements": null, "privileges_required": "NONE", "user_interaction": "NONE", "vulnerable_system_confidentiality": "HIGH", "vulnerable_system_integrity": "HIGH", "vulnerable_system_availability": "HIGH", "subsequent_system_confidentiality": null, "subsequent_system_integrity": null, "subsequent_system_availability": null, "exploit_maturity": null, "confidentiality_requirements": null, "integrity_requirements": null, "availability_requirements": null, "modified_attack_vector": null, "modified_attack_complexity": null, "modified_attack_requirements": null, "modified_privileges_required": null, "modified_user_interaction": null, "modified_vulnerable_system_confidentiality": null, "modified_vulnerable_system_integrity": null, "modified_vulnerable_system_availability": null, "modified_subsequent_system_confidentiality": null, "modified_subsequent_system_integrity": null, "modified_subsequent_system_availability": null, "safety": null, "automatable": null, "recovery": null, "value_density": null, "vulnerability_response_effort": null, "provider_urgency": null, "base_score": 10.0, "base_severity": "CRITICAL" } } } } ] } ``` ## Related Examples - [CVSS v3.0: Highest Exploitability Score](/reference/vulnerability/search/examples/metrics-cvss-metric-v30-exploitability-score/) - [CVSS v3.0: High Availability Impact](/reference/vulnerability/search/examples/metrics-cvss-metric-v30-cvss-data-availability-impact/) - [CVSS v3.0: No Integrity Impact](/reference/vulnerability/search/examples/metrics-cvss-metric-v30-cvss-data-integrity-impact/) - [CVSS v3.0: Low Confidentiality Impact](/reference/vulnerability/search/examples/metrics-cvss-metric-v30-cvss-data-confidentiality-impact/) - [CVSS v3.0: Changed Scope](/reference/vulnerability/search/examples/metrics-cvss-metric-v30-cvss-data-scope/) - [CVSS v3.0: User Interaction Required](/reference/vulnerability/search/examples/metrics-cvss-metric-v30-cvss-data-user-interaction/)