Log in Start free

Vulnerability · Published Nov 19, 2020 · Assigned by redhat

CVE-2020-25701

Medium 5.3

In plain English

A medium-severity improper access control in moodle. There are no confirmed reports of exploitation so far. The chance it is exploited in the next 30 days is estimated at 1.4% (higher than 72% of all known vulnerabilities). Fixed versions are available - upgrade the affected package.

Severity (CVSS NVD)5.3Medium
Exploit odds (30 days)1.4%top 27.7% of all CVEs
Exploited in the wildNo reportsnot in CISA KEV
Attack toolingNoneno public tooling known

Official description

If the upload course tool in Moodle was used to delete an enrollment method which did not exist or was not already enabled, the tool would erroneously enable that enrollment method. This could lead to unintended users gaining access to the course. Versions affected: 3.9 to 3.9.2, 3.8 to 3.8.5, 3.7 to 3.7.8, 3.5 to 3.5.14 and earlier unsupported versions. This is fixed in moodle 3.9.3, 3.8.6, 3.7.9, 3.5.15, and 3.10.

Affected packages & fixed versions

EcosystemPackageFixed inAdvisory
Packagistmoodle/moodle3.9.3GHSA-c9hq-g4q8-w893
Packagistmoodle/moodle3.8.6GHSA-c9hq-g4q8-w893
Packagistmoodle/moodle3.7.9GHSA-c9hq-g4q8-w893
Packagistmoodle/moodle3.5.15GHSA-c9hq-g4q8-w893

Affected products (as reported)

VendorProductVersions
n/a moodle Fixed in 3.9.3Fixed in 3.8.6Fixed in 3.7.9Fixed in 3.5.15Fixed in 3.10

Weakness: CWE-284

References