PT-2010-3286 · Moodle · Moodle

David Mudrák + 1 · Publicado 2010-04-29 · Atualizado 2022-05-13 · CVE-2010-1616

Positive Technologies (AI Summary)

CVSS v2.0

4.0

Média

Vetor base

AV:N/AC:L/Au:S/C:N/I:P/A:N

Name of the Vulnerable Software and Affected Versions Moodle versions 1.8.x through 1.9.7

Description The issue allows teachers to create new accounts even if they do not have the moodle/user:create capability, by creating new roles when restoring a course.

Recommendations For Moodle versions 1.8.x through 1.9.7, update to version 1.9.8 or later to resolve the issue.

Correção

Improper Access Control

Enumeração de Fraquezas

CWE-284

Identificadores relacionados

CVE-2010-1616

DSA-2115-1

GHSA-966M-M549-2878

Produtos afetados

Moodle

Referências · 12

• https://github.com/moodle/moodle · Nota
• https://github.com/moodle/moodle/commit/55f5b2e8b84e6390c0917195d01a3b34c33ff398 · Nota
• https://github.com/moodle/moodle/commit/5d9ab024ac9c311c84716628cce9a124173a2e8b · Nota
• https://github.com/moodle/moodle/commit/d8ada21339ecc147eccaaae97678f5368ac05f8b · Nota
• https://github.com/moodle/moodle/commit/b0ccfc5ce87f09d4df814b057f5e6820d37fdad1 · Nota
• https://github.com/moodle/moodle/commit/5e934890c9fbe28bf89362d3eb6140208b5e3464 · Nota
• https://osv.dev/vulnerability/GHSA-966m-m549-2878 · Aviso do Fabricante
• http://moodle.org/security · Nota
• https://nvd.nist.gov/vuln/detail/CVE-2010-1616 · Nota de Segurança
• http://vupen.com/english/advisories/2010/1107 · Nota
• http://tracker.moodle.org/browse/MDL-16658 · Nota
• http://lists.opensuse.org/opensuse-security-announce/2010-05/msg00001.html · Aviso do Fabricante