PT-2010-3286 · Moodle · Moodle

David Mudrák + 1 · Published 2010-04-29 · Updated 2022-05-13 · CVE-2010-1616

Positive Technologies (AI Summary)

CVSS v2.0

4.0

Medium

Base vector

AV:N/AC:L/Au:S/C:N/I:P/A:N

Name of the Vulnerable Software and Affected Versions Moodle versions 1.8.x through 1.9.7

Description The issue allows teachers to create new accounts even if they do not have the moodle/user:create capability, by creating new roles when restoring a course.

Recommendations For Moodle versions 1.8.x through 1.9.7, update to version 1.9.8 or later to resolve the issue.

Fix

Improper Access Control

Weakness Enumeration

CWE-284

Related Identifiers

CVE-2010-1616

DSA-2115-1

GHSA-966M-M549-2878

Affected Products

Moodle

References · 12

• https://osv.dev/vulnerability/GHSA-966m-m549-2878 · Vendor Advisory
• https://nvd.nist.gov/vuln/detail/CVE-2010-1616 · Security Note
• http://lists.opensuse.org/opensuse-security-announce/2010-05/msg00001.html · Vendor Advisory
• https://github.com/moodle/moodle · Note
• https://github.com/moodle/moodle/commit/55f5b2e8b84e6390c0917195d01a3b34c33ff398 · Note
• https://github.com/moodle/moodle/commit/5d9ab024ac9c311c84716628cce9a124173a2e8b · Note
• https://github.com/moodle/moodle/commit/d8ada21339ecc147eccaaae97678f5368ac05f8b · Note
• https://github.com/moodle/moodle/commit/b0ccfc5ce87f09d4df814b057f5e6820d37fdad1 · Note
• https://github.com/moodle/moodle/commit/5e934890c9fbe28bf89362d3eb6140208b5e3464 · Note
• http://moodle.org/security · Note
• http://vupen.com/english/advisories/2010/1107 · Note
• http://tracker.moodle.org/browse/MDL-16658 · Note