CVE-2020-25701 Information

Description

If the upload course tool in Moodle was used to delete an enrollment method which did not exist or was not already enabled the tool would erroneously enable that enrollment method. This could lead to unintended users gaining access to the course. Versions affected: 3.9 to 3.9.2 3.8 to 3.8.5 3.7 to 3.7.8 3.5 to 3.5.14 and earlier unsupported versions. This is fixed in moodle 3.9.3 3.8.6 3.7.9 3.5.15 and 3.10.

CVSS Vector

CVSS:3.1/AV:N/AC:L/PR:N/UI:N/S:U/C:N/I:L/A:N

Reference

https://moodle.org/mod/forum/discuss.php?d=413939 https://bugzilla.redhat.com/show_bug.cgi?id=1895432 https://lists.fedoraproject.org/archives/list/package-announce@lists.fedoraproject.org/message/B55KXBVAT45MDASJ3EK6VIGQOYGJ4NH6/ https://lists.fedoraproject.org/archives/list/package-announce@lists.fedoraproject.org/message/4NNFCHPPHRJNJROIX6SYMHOC6HMKP3GU/

Attack Complexity

LOW

Privileges Required

NONE

User Interaction Required

NONE

Scope

NONE

Confidentiality Impact

UNCHANGED

Integrity Impact

NONE

Availability Impact

LOW

Base Score

NONE

Base Severity

5.3