PT-2020-16162 · Moodle+1 · Moodle+1

Dani Palou · Published 2020-11-08 · Updated 2024-03-06 · CVE-2020-25700

Positive Technologies (AI Summary)

CVSS v3.1

6.5

Medium

Base vector

AV:N/AC:L/PR:L/UI:N/S:U/C:N/I:H/A:N

Name of the Vulnerable Software and Affected Versions moodle versions 3.5 through 3.5.14 moodle versions 3.7 through 3.7.8 moodle versions 3.8 through 3.8.5 moodle versions 3.9 through 3.9.2

Description In moodle, some database module web services allowed students to add entries within groups they did not belong to. This issue is fixed in moodle 3.8.6, 3.7.9, 3.5.15, and 3.10.

Recommendations For moodle versions 3.5 through 3.5.14, update to version 3.5.15 to resolve the issue. For moodle versions 3.7 through 3.7.8, update to version 3.7.9 to resolve the issue. For moodle versions 3.8 through 3.8.5, update to version 3.8.6 to resolve the issue. For moodle versions 3.9 through 3.9.2, update to version 3.10 to resolve the issue.

Fix

SQL injection

Weakness Enumeration

CWE-89

Related Identifiers

ALT-PU-2020-3235

ALT-PU-2020-3289

ALT-PU-2022-1641

BIT-MOODLE-2020-25700

CVE-2020-25700

GHSA-7H8V-2V8X-H264

Affected Products

Alt Linux

Moodle

References · 15

• https://osv.dev/vulnerability/BIT-moodle-2020-25700 · Vendor Advisory
• https://lists.fedoraproject.org/archives/list/package-announce%40lists.fedoraproject.org/message/B55KXBVAT45MDASJ3EK6VIGQOYGJ4NH6 · Vendor Advisory
• https://lists.fedoraproject.org/archives/list/package-announce%40lists.fedoraproject.org/message/4NNFCHPPHRJNJROIX6SYMHOC6HMKP3GU · Vendor Advisory
• https://lists.fedoraproject.org/archives/list/[e-mail]/message/B55KXBVAT45MDASJ3EK6VIGQOYGJ4NH6 · Vendor Advisory
• https://moodle.org/mod/forum/discuss.php?d=413938 · Vendor Advisory
• https://ubuntu.com/security/CVE-2020-25700 · Vendor Advisory
• https://osv.dev/vulnerability/CVE-2020-25700 · Vendor Advisory
• https://nvd.nist.gov/vuln/detail/CVE-2020-25700 · Security Note
• https://cve.org/CVERecord?id=CVE-2020-25700 · Security Note
• https://osv.dev/vulnerability/UBUNTU-CVE-2020-25700 · Vendor Advisory
• https://lists.fedoraproject.org/archives/list/[e-mail]/message/4NNFCHPPHRJNJROIX6SYMHOC6HMKP3GU · Vendor Advisory
• https://osv.dev/vulnerability/GHSA-7h8v-2v8x-h264 · Vendor Advisory
• https://github.com/moodle/moodle/commit/8169aeff59d8ed910ca3545413561005282bbd32 · Note
• https://bugzilla.redhat.com/show_bug.cgi?id=1895427 · Note
• https://t.me/cibsecurity/16602 · Telegram Post