CVE-2020-25698
Users' enrollment capabilities were not being sufficiently checked in Moodle when they are restored into an existing course. This could lead to them unenrolling users without having permission to do so. Versions affected: 3.5 to 3.5.14, 3.7 to 3.7.8, 3.8 to 3.8.5, 3.9 to 3.9.2 and earlier unsupported versions. Fixed in 3.9.3, 3.8.6, 3.7.9, 3.5.15, and 3.10.
| Software | From | Fixed in |
|---|---|---|
moodle / moodle
|
3.9.0 | 3.9.2.x |
|
moodle / moodle
|
3.8.0 | 3.8.5.x |
|
moodle / moodle
|
3.7.0 | 3.7.8.x |
|
moodle / moodle
|
3.5.0 | 3.5.14.x |
| fedoraproject / fedora | 32 | 32.x |
| fedoraproject / fedora | 33 | 33.x |
|
moodle / moodle
|
3.9.0 | 3.9.3 |
|
moodle / moodle
|
3.8.0 | 3.8.6 |
|
moodle / moodle
|
3.7.0 | 3.7.9 |
|
moodle / moodle
|
- | 3.5.15 |
- https://bugzilla.redhat.com/show_bug.cgi?id=1895419
- https://github.com/moodle/moodle/commit/c8ac07fb50fa92eee1d574823fbda09e1b309a63
- https://lists.fedoraproject.org/archives/list/package-announce@lists.fedoraproject.org/message/4NNFCHPPHRJNJROIX6SYMHOC6HMKP3GU/
- https://lists.fedoraproject.org/archives/list/package-announce@lists.fedoraproject.org/message/B55KXBVAT45MDASJ3EK6VIGQOYGJ4NH6/
- https://lists.fedoraproject.org/archives/list/package-announce%40lists.fedoraproject.org/message/4NNFCHPPHRJNJROIX6SYMHOC6HMKP3GU/
- https://lists.fedoraproject.org/archives/list/package-announce%40lists.fedoraproject.org/message/B55KXBVAT45MDASJ3EK6VIGQOYGJ4NH6/
- https://moodle.org/mod/forum/discuss.php?d=413935
Deep Security Visibility Without the Complexity
SynScan provides clear, real-time security insights so you can monitor your attack surface, spot risks early, and act fast—without extra complexity.
- No setup fees
- 5-min deployment
- Cancel anytime