~ / search / GHSA-vxhx-gmhm-623c

GHSA-vxhx-gmhm-623c

Improper Access Control in moodle

Source: GitHub Advisory Database (reviewed) High CVE-2020-25698

Packages

EcosystemPackageAffectedFixed in
Packagist moodle/moodle >= 3.9.0, < 3.9.3 3.9.3
Packagist moodle/moodle >= 3.8.0, < 3.8.6 3.8.6
Packagist moodle/moodle >= 3.7.0, < 3.7.9 3.7.9
Packagist moodle/moodle >= 3.5, < 3.5.15 3.5.15

Details

As written in the advisory (Markdown source, shown as plain text).

Users' enrollment capabilities were not being sufficiently checked in Moodle when they are restored into an existing course. This could lead to them unenrolling users without having permission to do so. Versions affected: 3.5 to 3.5.14, 3.7 to 3.7.8, 3.8 to 3.8.5, 3.9 to 3.9.2 and earlier unsupported versions. Fixed in 3.9.3, 3.8.6, 3.7.9, 3.5.15, and 3.10.

References

External links from the advisory. They lead to third-party sites.