Moodle < 3.5.14, 3.7.x < 3.7.9, 3.8.x < 3.8.6, 3.9.x < 3.9.3 Multiple Vulnerabilities

Moodle is prone to multiple vulnerabilities. Copyright C 2020 Greenbone Networks GmbH Some text descriptions might be excerpted from a referenced sources, and are Copyright C by the respective right holders. SPDX-License-Identifier: GPL-2.0-or-later This program is free software; you can...

Moodle Access Control Error Vulnerability

Moodle is a free, open-source e-learning software platform, also known as a course management system, learning management system or virtual learning environment. Moodle suffers from an access control error vulnerability that stems from the fact that if the Upload Course tool is used to delete an...

Authorization Bypass

moodle/moodle is vulnerable to authorization bypass. A teacher is able to un-enrol users without permission using course restore...

Privilege Escalation

Moodle is vulnerable to privilege escalation. Users with the ability to course restore are able to add additional capabilities to roles within that course because it does not check the user's permission to change capabilities...

Privilege Escalation

moodle/moodle is vulnerable to privilege escalation. The vulnerability exists when an enrollment method that did not exist, or was disabled, would be enabled if it was deleted, allowing unintended users access to the course...

CVE-2020-25701

If the upload course tool in Moodle was used to delete an enrollment method which did not exist or was not already enabled, the tool would erroneously enable that enrollment method. This could lead to unintended users gaining access to the course. Versions affected: 3.9 to 3.9.2, 3.8 to 3.8.5, 3....

UBUNTU-CVE-2020-25698

Users' enrollment capabilities were not being sufficiently checked in Moodle when they are restored into an existing course. This could lead to them unenrolling users without having permission to do so. Versions affected: 3.5 to 3.5.14, 3.7 to 3.7.8, 3.8 to 3.8.5, 3.9 to 3.9.2 and earlier...

UBUNTU-CVE-2020-25699

In moodle, insufficient capability checks could lead to users with the ability to course restore adding additional capabilities to roles within that course. Versions affected: 3.9 to 3.9.2, 3.8 to 3.8.5, 3.7 to 3.7.8, 3.5 to 3.5.14 and earlier unsupported versions. This is fixed in moodle 3.9.3,...

CVE-2020-25699

In moodle, insufficient capability checks could lead to users with the ability to course restore adding additional capabilities to roles within that course. Versions affected: 3.9 to 3.9.2, 3.8 to 3.8.5, 3.7 to 3.7.8, 3.5 to 3.5.14 and earlier unsupported versions. This is fixed in moodle 3.9.3,...

UBUNTU-CVE-2020-25701

If the upload course tool in Moodle was used to delete an enrollment method which did not exist or was not already enabled, the tool would erroneously enable that enrollment method. This could lead to unintended users gaining access to the course. Versions affected: 3.9 to 3.9.2, 3.8 to 3.8.5, 3....

CVE-2020-25701

CVE-2020-25701 describes a Moodle vulnerability where the upload course tool would erroneously enable an enrollment method when deleting one that didn’t exist or wasn’t enabled, potentially letting unintended users access a course. Affected versions include Moodle 3.9.x (3.9.2 and earlier), 3.8.x...

Moodle Unauthorized Access Vulnerability (CNVD-2020-65138)

Moodle is a free, open-source e-learning software platform, also known as a course management system, learning management system or virtual learning environment. Moodle suffers from a security vulnerability that stems from inappropriate access restrictions in the process when restoring role...

Moodle 访问控制错误漏洞

Moodle is a free, open-source e-learning software platform, also known as a course management system, learning management system or virtual learning environment. Moodle suffers from an Access Control Error vulnerability that stems from a failure to adequately check a user's ability to enroll when...

Moodle 访问控制错误漏洞

Moodle is a free, open-source e-learning software platform, also known as a course management system, learning management system or virtual learning environment. Moodle suffers from an access control error vulnerability that stems from the fact that if the Upload Course tool is used to delete an...

Moodle 访问控制错误漏洞

Moodle is a free, open-source e-learning software platform, also known as a course management system, learning management system or virtual learning environment. Moodle suffers from a security vulnerability that stems from inappropriate access restrictions in the process when restoring role...

PT-2023-16959 · Moodle +1 · Moodle +1

Name of the Vulnerable Software and Affected Versions: Moodle versions affected versions not specified Description: The issue concerns the course participation report, which required additional checks to prevent displaying roles that the user did not have access to view. Recommendations: At the...

PT-2020-16163 · Moodle +1 · Moodle +1

Name of the Vulnerable Software and Affected Versions: Moodle versions 3.5 to 3.5.14 Moodle versions 3.7 to 3.7.8 Moodle versions 3.8 to 3.8.5 Moodle versions 3.9 to 3.9.2 Description: The upload course tool in Moodle contains an issue where deleting a non-existent or disabled enrollment method...

PT-2022-5977 · Moodle +2 · Moodle +2

Name of the Vulnerable Software and Affected Versions: Moodle affected versions not specified Description: A vulnerability exists in Moodle due to insufficient validation of the HTTP request origin in course redirect URL. This allows a remote attacker to trick a victim into visiting a specially...

PT-2020-16161 · Moodle +1 · Moodle +1

Name of the Vulnerable Software and Affected Versions: moodle versions 3.5 to 3.5.14 moodle versions 3.7 to 3.7.8 moodle versions 3.8 to 3.8.5 moodle versions 3.9 to 3.9.2 Description: Insufficient capability checks in moodle could lead to users with the ability to course restore adding additiona...

PT-2020-16138 · Moodle +1 · Moodle +1

Name of the Vulnerable Software and Affected Versions: Moodle versions 3.5 through 3.5.13 Moodle versions 3.7 through 3.7.7 Moodle versions 3.8 through 3.8.4 Moodle versions 3.9 through 3.9.1 Description: A vulnerability was found in Moodle where users with Log in as capability in a course contex...