PT-2022-8587 · Moodle+1 · Moodle+1

Tim Hunt · Published 2020-03-10 · Updated 2024-03-06 · CVE-2020-1754

Positive Technologies (AI Summary)

CVSS v3.1

4.3

Medium

Base vector

AV:N/AC:L/PR:L/UI:N/S:U/C:L/I:N/A:N

Name of the Vulnerable Software and Affected Versions Moodle versions prior to 3.8.2 Moodle versions prior to 3.7.5 Moodle versions prior to 3.6.9 Moodle versions prior to 3.5.11

Description The issue allows users to view the grade history report without proper restrictions. Specifically, users without the 'access all groups' capability could view grades of users outside their own groups.

Recommendations For versions prior to 3.8.2, update to version 3.8.2 or later. For versions prior to 3.7.5, update to version 3.7.5 or later. For versions prior to 3.6.9, update to version 3.6.9 or later. For versions prior to 3.5.11, update to version 3.5.11 or later.

Fix

Improper Access Control

Incorrect Permission

Weakness Enumeration

CWE-284

CWE-732

Related Identifiers

ALT-PU-2020-1443

ALT-PU-2020-1977

BIT-MOODLE-2020-1754

CVE-2020-1754

Affected Products

Alt Linux

Moodle

References · 7

• https://osv.dev/vulnerability/BIT-moodle-2020-1754 · Vendor Advisory
• https://osv.dev/vulnerability/UBUNTU-CVE-2020-1754 · Vendor Advisory
• https://nvd.nist.gov/vuln/detail/CVE-2020-1754 · Security Note
• https://ubuntu.com/security/CVE-2020-1754 · Vendor Advisory
• https://moodle.org/mod/forum/discuss.php?d=398350 · Vendor Advisory
• https://osv.dev/vulnerability/CVE-2020-1754 · Vendor Advisory
• https://cve.org/CVERecord?id=CVE-2020-1754 · Security Note