CVEvulnerability

CVE-2020-25701

5.3 MEDIUM Published 2020-11-19 Modified 2026-06-17 Official page ↗
Status
Modified
Published
2020-11-19
Last modified
2026-06-17
Assigner
[email protected]
CVSS 3.1 ([email protected])
5.3 MEDIUM — CVSS:3.1/AV:N/AC:L/PR:N/UI:N/S:U/C:N/I:L/A:N
CVSS 2.0 ([email protected])
5.0 MEDIUM — AV:N/AC:L/Au:N/C:N/I:P/A:N
Weaknesses
CWE-284, CWE-863

Description

If the upload course tool in Moodle was used to delete an enrollment method which did not exist or was not already enabled, the tool would erroneously enable that enrollment method. This could lead to unintended users gaining access to the course. Versions affected: 3.9 to 3.9.2, 3.8 to 3.8.5, 3.7 to 3.7.8, 3.5 to 3.5.14 and earlier unsupported versions. This is fixed in moodle 3.9.3, 3.8.6, 3.7.9, 3.5.15, and 3.10.

Affected configurations

• moodle moodle (>= 3.5.0 <= 3.5.14) • moodle moodle (>= 3.7.0 <= 3.7.8) • moodle moodle (>= 3.8.0 <= 3.8.5) • moodle moodle (>= 3.9.0 <= 3.9.2) • fedoraproject fedora 32 • fedoraproject fedora 33

Related

Weakness · CWE (2)

  • CWE-284 Improper Access Control weakness
  • CWE-863 Incorrect Authorization weakness

References