PT-2020-16138 · Moodle+1 · Moodle+1

Florence Thiard · Published 2020-10-15 · Updated 2024-03-06 · CVE-2020-25629

Positive Technologies (AI Summary)

CVSS v3.1

8.8

High

Base vector

AV:N/AC:L/PR:L/UI:N/S:U/C:H/I:H/A:H

Name of the Vulnerable Software and Affected Versions Moodle versions 3.5 through 3.5.13 Moodle versions 3.7 through 3.7.7 Moodle versions 3.8 through 3.8.4 Moodle versions 3.9 through 3.9.1

Description A vulnerability was found in Moodle where users with Log in as capability in a course context, typically course managers, may gain access to some site administration capabilities by logging in as a System manager.

Recommendations For versions 3.5 through 3.5.13, update to version 3.5.14. For versions 3.7 through 3.7.7, update to version 3.7.8. For versions 3.8 through 3.8.4, update to version 3.8.5. For versions 3.9 through 3.9.1, update to version 3.9.2.

Fix

Improper Access Control

Missing Authorization

Weakness Enumeration

CWE-284

CWE-862

Related Identifiers

ALT-PU-2020-3059

ALT-PU-2020-3289

ALT-PU-2022-1641

BIT-MOODLE-2020-25629

CVE-2020-25629

GHSA-F5R8-7H4F-JR9X

Affected Products

Alt Linux

Moodle

References · 11

• https://moodle.org/mod/forum/discuss.php?d=410841 · Vendor Advisory
• https://osv.dev/vulnerability/UBUNTU-CVE-2020-25629 · Vendor Advisory
• https://nvd.nist.gov/vuln/detail/CVE-2020-25629 · Security Note
• https://cve.org/CVERecord?id=CVE-2020-25629 · Security Note
• https://osv.dev/vulnerability/GHSA-f5r8-7h4f-jr9x · Vendor Advisory
• https://osv.dev/vulnerability/CVE-2020-25629 · Vendor Advisory
• https://ubuntu.com/security/CVE-2020-25629 · Vendor Advisory
• https://osv.dev/vulnerability/BIT-moodle-2020-25629 · Vendor Advisory
• https://github.com/moodle/moodle · Note
• https://t.me/cibsecurity/17229 · Telegram Post
• https://t.me/cvenotify/6718 · Telegram Post