PT-2020-16161 · Moodle+1 · Moodle+1

Matt Petro · Published 2020-11-08 · Updated 2024-03-06 · CVE-2020-25699

Positive Technologies (AI Summary)

CVSS v3.1

7.5

High

Base vector

AV:N/AC:L/PR:N/UI:N/S:U/C:N/I:H/A:N

Name of the Vulnerable Software and Affected Versions moodle versions 3.5 to 3.5.14 moodle versions 3.7 to 3.7.8 moodle versions 3.8 to 3.8.5 moodle versions 3.9 to 3.9.2

Description Insufficient capability checks in moodle could lead to users with the ability to course restore adding additional capabilities to roles within that course. This issue is fixed in moodle 3.9.3, 3.8.6, 3.7.9, 3.5.15, and 3.10.

Recommendations For moodle versions 3.5 to 3.5.14, update to version 3.5.15 or later. For moodle versions 3.7 to 3.7.8, update to version 3.7.9 or later. For moodle versions 3.8 to 3.8.5, update to version 3.8.6 or later. For moodle versions 3.9 to 3.9.2, update to version 3.9.3 or later.

Fix

Incorrect Authorization

Improper Privilege Management

Weakness Enumeration

CWE-863

CWE-269

Related Identifiers

ALT-PU-2020-3235

ALT-PU-2020-3289

ALT-PU-2022-1641

BIT-MOODLE-2020-25699

CVE-2020-25699

GHSA-H77R-RP97-7RV4

Affected Products

Alt Linux

Moodle

References · 17

• https://osv.dev/vulnerability/CVE-2020-25699 · Vendor Advisory
• https://lists.fedoraproject.org/archives/list/package-announce%40lists.fedoraproject.org/message/4NNFCHPPHRJNJROIX6SYMHOC6HMKP3GU · Vendor Advisory
• https://lists.fedoraproject.org/archives/list/[e-mail]/message/B55KXBVAT45MDASJ3EK6VIGQOYGJ4NH6 · Vendor Advisory
• https://lists.fedoraproject.org/archives/list/package-announce%40lists.fedoraproject.org/message/B55KXBVAT45MDASJ3EK6VIGQOYGJ4NH6 · Vendor Advisory
• https://osv.dev/vulnerability/UBUNTU-CVE-2020-25699 · Vendor Advisory
• https://moodle.org/mod/forum/discuss.php?d=413936 · Vendor Advisory
• https://cve.org/CVERecord?id=CVE-2020-25699 · Security Note
• https://lists.fedoraproject.org/archives/list/[e-mail]/message/4NNFCHPPHRJNJROIX6SYMHOC6HMKP3GU · Vendor Advisory
• https://osv.dev/vulnerability/BIT-moodle-2020-25699 · Vendor Advisory
• https://nvd.nist.gov/vuln/detail/CVE-2020-25699 · Security Note
• https://osv.dev/vulnerability/GHSA-h77r-rp97-7rv4 · Vendor Advisory
• https://ubuntu.com/security/CVE-2020-25699 · Vendor Advisory
• https://github.com/moodle/moodle · Note
• https://github.com/moodle/moodle/commit/b8e1eec4c77c858de87fedf4e405e929539ea0c5 · Note
• https://t.me/cibsecurity/16603 · Telegram Post