~ / search / GHSA-grj4-g57c-9xmv

GHSA-grj4-g57c-9xmv

Moodle Bypass email verification secret when confirming account registration

Source: GitHub Advisory Database (reviewed) Moderate CVE-2021-20282

Packages

EcosystemPackageAffectedFixed in
Packagist moodle/moodle >= 3.5, < 3.5.17 3.5.17
Packagist moodle/moodle >= 3.8, < 3.8.8 3.8.8
Packagist moodle/moodle >= 3.9, < 3.9.5 3.9.5
Packagist moodle/moodle >= 3.10, < 3.10.2 3.10.2

Details

As written in the advisory (Markdown source, shown as plain text).

When creating a user account, it was possible to verify the account without having access to the verification email link/secret in moodle before 3.10.2, 3.9.5, 3.8.8, 3.5.17.

References

External links from the advisory. They lead to third-party sites.