PT-2020-16165 · Moodle+1 · Moodle+1

A. Schenkel · Published 2020-11-08 · Updated 2024-03-06 · CVE-2020-25703

Positive Technologies (AI Summary)

CVSS v3.1

5.3

Medium

Base vector

AV:N/AC:L/PR:N/UI:N/S:U/C:L/I:N/A:N

Name of the Vulnerable Software and Affected Versions Moodle versions 3.7 through 3.7.8 Moodle versions 3.8 through 3.8.5 Moodle versions 3.9 through 3.9.2

Description The participants table download in Moodle always included user emails, but should have only done so when users' emails are not hidden. This issue was fixed in Moodle versions 3.9.3, 3.8.6, 3.7.9, and 3.10.

Recommendations For Moodle versions 3.7 through 3.7.8, update to version 3.7.9 or later. For Moodle versions 3.8 through 3.8.5, update to version 3.8.6 or later. For Moodle versions 3.9 through 3.9.2, update to version 3.9.3 or later.

Fix

Information Disclosure

Weakness Enumeration

CWE-201

CWE-200

Related Identifiers

ALT-PU-2020-3235

ALT-PU-2020-3289

ALT-PU-2022-1641

BIT-MOODLE-2020-25703

CVE-2020-25703

GHSA-C7V4-M269-4995

Affected Products

Alt Linux

Moodle

References · 15

• https://moodle.org/mod/forum/discuss.php?d=413941 · Vendor Advisory
• https://osv.dev/vulnerability/GHSA-c7v4-m269-4995 · Vendor Advisory
• https://lists.fedoraproject.org/archives/list/package-announce%40lists.fedoraproject.org/message/4NNFCHPPHRJNJROIX6SYMHOC6HMKP3GU · Vendor Advisory
• https://lists.fedoraproject.org/archives/list/[e-mail]/message/B55KXBVAT45MDASJ3EK6VIGQOYGJ4NH6 · Vendor Advisory
• https://nvd.nist.gov/vuln/detail/CVE-2020-25703 · Security Note
• https://lists.fedoraproject.org/archives/list/package-announce%40lists.fedoraproject.org/message/B55KXBVAT45MDASJ3EK6VIGQOYGJ4NH6 · Vendor Advisory
• https://osv.dev/vulnerability/BIT-moodle-2020-25703 · Vendor Advisory
• https://osv.dev/vulnerability/UBUNTU-CVE-2020-25703 · Vendor Advisory
• https://lists.fedoraproject.org/archives/list/[e-mail]/message/4NNFCHPPHRJNJROIX6SYMHOC6HMKP3GU · Vendor Advisory
• https://osv.dev/vulnerability/CVE-2020-25703 · Vendor Advisory
• https://cve.org/CVERecord?id=CVE-2020-25703 · Security Note
• https://ubuntu.com/security/CVE-2020-25703 · Vendor Advisory
• https://github.com/moodle/moodle · Note
• https://bugzilla.redhat.com/show_bug.cgi?id=1895439 · Note
• https://t.me/cibsecurity/16606 · Telegram Post