~ / search / GHSA-7h8v-2v8x-h264

GHSA-7h8v-2v8x-h264

SQL Injection in moodle

Source: GitHub Advisory Database (reviewed) Moderate CVE-2020-25700

Packages

EcosystemPackageAffectedFixed in
Packagist moodle/moodle >= 3.9.0, < 3.9.3 3.9.3
Packagist moodle/moodle >= 3.8.0, < 3.8.6 3.8.6
Packagist moodle/moodle >= 3.7.0, < 3.7.9 3.7.9
Packagist moodle/moodle >= 3.5.0, < 3.5.15 3.5.15

Details

As written in the advisory (Markdown source, shown as plain text).

In moodle, some database module web services allowed students to add entries within groups they did not belong to. Versions affected: 3.9 to 3.9.2, 3.8 to 3.8.5, 3.7 to 3.7.8, 3.5 to 3.5.14 and earlier unsupported versions. This is fixed in moodle 3.8.6, 3.7.9, 3.5.15, and 3.10.

References

External links from the advisory. They lead to third-party sites.