GHSA-2m72-m5cw-3g9h
Missing permission check in Moodle
At a glance
- Published
- Updated
- CVE
- CVE-2021-20283
- Aliases
- BIT-moodle-2021-20283
- CVSS_V3
- CVSS:3.1/AV:N/AC:L/PR:L/UI:N/S:U/C:L/I:N/A:N
Description
The web service responsible for fetching other users' enrolled courses did not validate that the requesting user had permission to view that information in each course in moodle before 3.10.2, 3.9.5, 3.8.8, 3.5.17.
Affected packages
| Package | Versions |
|---|---|
| Packagist · moodle/moodle | introduced 3.10.0, fixed 3.10.2 |
| Packagist · moodle/moodle | introduced 3.9.0, fixed 3.9.5 |
| Packagist · moodle/moodle | introduced 3.8.0, fixed 3.8.8 |
| Packagist · moodle/moodle | introduced 0, fixed 3.5.17 |
References
- https://nvd.nist.gov/vuln/detail/CVE-2021-20283 ADVISORY
- https://bugzilla.redhat.com/show_bug.cgi?id=1939051 WEB
- https://github.com/moodle/moodle PACKAGE
- https://lists.fedoraproject.org/archives/list/package-announce@lists.fedoraproject.org/message/AFSNJ7XHVTC52RSRX2GBQFF3VEEAY2MS WEB
- https://lists.fedoraproject.org/archives/list/package-announce@lists.fedoraproject.org/message/UFH5DDMU5TZ3JT4Q52WMRAHACA5MHIMT WEB
- https://moodle.org/mod/forum/discuss.php?d=419654 WEB
Sources
| Source | Licence |
|---|---|
| OSV.dev | CC-BY 4.0 — GitHub Advisory Database |