GitHub Advisoryadvisory · Packagist

GHSA-vxhx-gmhm-623c Improper Access Control in moodle

HIGH Published 2021-03-29 Modified 2021-03-24 Official page ↗
Aliases
CVE-2020-25698
Ecosystem
Packagist
Packages
moodle/moodle
Severity
High
CVSS vector
CVSS:3.1/AV:N/AC:L/PR:N/UI:N/S:U/C:N/I:H/A:N
Weaknesses
CWE-284
Reviewed
2021-03-24

Affected packages

• Packagist moodle/moodle: >= 3.9.0, < 3.9.3 → fixed in 3.9.3 • Packagist moodle/moodle: >= 3.8.0, < 3.8.6 → fixed in 3.8.6 • Packagist moodle/moodle: >= 3.7.0, < 3.7.9 → fixed in 3.7.9 • Packagist moodle/moodle: >= 3.5, < 3.5.15 → fixed in 3.5.15

Description

Users' enrollment capabilities were not being sufficiently checked in Moodle when they are restored into an existing course. This could lead to them unenrolling users without having permission to do so. Versions affected: 3.5 to 3.5.14, 3.7 to 3.7.8, 3.8 to 3.8.5, 3.9 to 3.9.2 and earlier unsupported versions. Fixed in 3.9.3, 3.8.6, 3.7.9, 3.5.15, and 3.10.

Related

Alias · CVE (1)

  • CVE-2020-25698 Users' enrollment capabilities were not being sufficiently checked in Moodle when they are restored into an existing course. vulnerability

Weakness · CWE (1)

  • CWE-284 Improper Access Control weakness

References