CVE-2020-25699
Last modified
CVE-2020-25699 is a high-severity vulnerability rated 7.5/10 on the CVSS scale. In moodle, insufficient capability checks could lead to users with the ability to course restore adding additional capabilities to roles within that course. Versions affected: 3.9 to 3.9.2, 3.8 to 3.8.5, 3.7 to 3.7.8, 3.5 to 3.5.14 and earlier unsupported versions. EPSS estimates a 1.59% chance of exploitation in the next 30 days.
Description
In moodle, insufficient capability checks could lead to users with the ability to course restore adding additional capabilities to roles within that course. Versions affected: 3.9 to 3.9.2, 3.8 to 3.8.5, 3.7 to 3.7.8, 3.5 to 3.5.14 and earlier unsupported versions. This is fixed in moodle 3.9.3, 3.8.6, 3.7.9, 3.5.15, and 3.10.
Metrics
CVSS:3.1/AV:N/AC:L/PR:N/UI:N/S:U/C:N/I:H/A:N
Weakness Enumeration
Affected Software
| Vendor | Product | Versions |
|---|---|---|
| Moodle | Moodle | >= 3.5.0, <= 3.5.14 |
| Moodle | Moodle | >= 3.7.0, <= 3.7.8 |
| Moodle | Moodle | >= 3.8.0, <= 3.8.5 |
| Moodle | Moodle | >= 3.9.0, <= 3.9.2 |
| Fedoraproject | Fedora | 32 |
| Fedoraproject | Fedora | 33 |
References
- https://bugzilla.redhat.com/show_bug.cgi?id=1895425Issue Tracking, Third Party Advisory
- https://moodle.org/mod/forum/discuss.php?d=413936Vendor Advisory
- https://bugzilla.redhat.com/show_bug.cgi?id=1895425Issue Tracking, Third Party Advisory
- https://moodle.org/mod/forum/discuss.php?d=413936Vendor Advisory
Timeline
- Published
- Last Modified
- Status
- Modified
Frequently Asked Questions
What is CVE-2020-25699?
How severe is CVE-2020-25699?
How do I fix CVE-2020-25699?
How Strix Helps
- Uncovering a hidden BOLA in Appsmith's snapshot logicStrix autonomously discovered a BOLA/IDOR vulnerability in Appsmith's snapshot deletion path.
- Autonomous PentestingAI agents that find and validate exploitable vulnerabilities like this one across your applications.
- PR ReviewsPentest every pull request so vulnerable code is caught before it ships to production.
- AI Penetration TestingHow AI-driven penetration testing continuously covers your attack surface.
Related CVEs from 2020
- CVE-2020-25693A flaw was found in CImg in versions prior to 2.9.3. Integer…8.1
- CVE-2020-25694A flaw was found in PostgreSQL versions before 13.1, before …8.1
- CVE-2020-25695A flaw was found in PostgreSQL versions before 13.1, before …8.8
- CVE-2020-25696A flaw was found in the psql interactive terminal of Postgre…7.5
- CVE-2020-25697A privilege escalation flaw was found in the Xorg-x11-server…7
- CVE-2020-25698Users' enrollment capabilities were not being sufficiently c…7.5
- CVE-2020-2570Vulnerability in the MySQL Client product of Oracle MySQL (c…5.9
- CVE-2020-25700In moodle, some database module web services allowed student…6.5
- CVE-2020-25701If the upload course tool in Moodle was used to delete an en…5.3
- CVE-2020-25702In Moodle, it was possible to include JavaScript when re-nam…6.1
- CVE-2020-25703The participants table download in Moodle always included us…5.3
- CVE-2020-25704A flaw memory leak in the Linux kernel performance monitorin…5.5
Are you affected by CVE-2020-25699?
Run a free Strix scan to check your systems for this vulnerability.
Scan your code nowSource: NVD / NIST