~ / search / GHSA-h77r-rp97-7rv4

GHSA-h77r-rp97-7rv4

Privilage Escalation in moodle

Source: GitHub Advisory Database (reviewed) High CVE-2020-25699

Packages

EcosystemPackageAffectedFixed in
Packagist moodle/moodle >= 3.9.0, < 3.9.3 3.9.3
Packagist moodle/moodle >= 3.8.0, < 3.8.6 3.8.6
Packagist moodle/moodle >= 3.7.0, < 3.7.9 3.7.9
Packagist moodle/moodle >= 3.5, < 3.5.15 3.5.15

Details

As written in the advisory (Markdown source, shown as plain text).

In moodle, insufficient capability checks could lead to users with the ability to course restore adding additional capabilities to roles within that course. Versions affected: 3.9 to 3.9.2, 3.8 to 3.8.5, 3.7 to 3.7.8, 3.5 to 3.5.14 and earlier unsupported versions. This is fixed in moodle 3.9.3, 3.8.6, 3.7.9, 3.5.15, and 3.10.

References

External links from the advisory. They lead to third-party sites.