CVE-2020-25701CWE-284

If the upload course tool in Moodle was used to delete an enrollment method which did not exist or was not already enabled, the tool would erroneously enable…

published November 19, 2020

CVSS
—
EPSS
1%
Percentile
72.0
In the wild
Unconfirmed
What it is

If the upload course tool in Moodle was used to delete an enrollment method which did not exist or was not already enabled, the tool would erroneously enable that enrollment method. This could lead to unintended users gaining access to the course. Versions affected: 3.9 to 3.9.2, 3.8 to 3.8.5, 3.7 to 3.7.8, 3.5 to 3.5.14 and earlier unsupported versions. This is fixed in moodle 3.9.3, 3.8.6, 3.7.9, 3.5.15, and 3.10.

The record
Technical detail
CVSS
Not scored
CVSS v4.0
Not supplied
EPSS
0.01385 · 72.0th percentile
Weakness
CWE-284 · Improper Access Control
Published
2020-11-19T16:10Z
EPSS history
Timeline
  • 19 NOV 16:10Z
    If the upload course tool in Moodle was used to delete an enrollment method which did not exist or was not already enabled, the tool would erroneously enable…
    cvelistv5