GitHub Advisoryadvisory · Packagist

GHSA-2m72-m5cw-3g9h Missing permission check in Moodle

MEDIUM Published 2022-05-24 Modified 2024-04-23 Official page ↗
Aliases
CVE-2021-20283
Ecosystem
Packagist
Packages
moodle/moodle
Severity
Moderate
CVSS vector
CVSS:3.1/AV:N/AC:L/PR:L/UI:N/S:U/C:L/I:N/A:N
Weaknesses
CWE-862, CWE-863
Reviewed
2024-04-23

Affected packages

• Packagist moodle/moodle: >= 3.10.0, < 3.10.2 → fixed in 3.10.2 • Packagist moodle/moodle: >= 3.9.0, < 3.9.5 → fixed in 3.9.5 • Packagist moodle/moodle: >= 3.8.0, < 3.8.8 → fixed in 3.8.8 • Packagist moodle/moodle: < 3.5.17 → fixed in 3.5.17

Description

The web service responsible for fetching other users' enrolled courses did not validate that the requesting user had permission to view that information in each course in moodle before 3.10.2, 3.9.5, 3.8.8, 3.5.17.

Related

Alias · CVE (1)

  • CVE-2021-20283 The web service responsible for fetching other users' enrolled courses did not validate that the requesting user had permission to view… vulnerability

Weakness · CWE (2)

  • CWE-862 Missing Authorization weakness
  • CWE-863 Incorrect Authorization weakness

References