medium4.3
CVE-2021-20283
Missing permission check in Moodle
Impact
The web service responsible for fetching other users' enrolled courses did not validate that the requesting user had permission to view that information in each course in moodle before 3.10.2, 3.9.5, 3.8.8, 3.5.17.
Affected packages
| Ecosystem | Package | Affected | Fixed in |
|---|---|---|---|
| composer | moodle/moodle | >= 3.10.0, < 3.10.2 | 3.10.2 |
Affected products
| Vendor | Product | Affected versions |
|---|---|---|
| Moodle | Moodle | from 3.5.0 before 3.5.17 from 3.8.0 before 3.8.8 from 3.9.0 before 3.9.5 from 3.10.0 before 3.10.2 |
| Fedoraproject | Fedora | Versions 32, 34 |
Weakness classification
References
- NVD record
- CVE.org record
- GitHub advisory
- https://bugzilla.redhat.com/show_bug.cgi?id=1939051
- https://lists.fedoraproject.org/archives/list/package-announce%40lists.fedoraproject.org/message/AFSNJ7XHVTC52RSRX2GBQFF3VEEAY2MS/
- https://lists.fedoraproject.org/archives/list/package-announce%40lists.fedoraproject.org/message/UFH5DDMU5TZ3JT4Q52WMRAHACA5MHIMT/
- https://moodle.org/mod/forum/discuss.php?d=419654
- https://github.com/advisories/GHSA-2m72-m5cw-3g9h
- https://nvd.nist.gov/vuln/detail/CVE-2021-20283
- https://lists.fedoraproject.org/archives/list/package-announce@lists.fedoraproject.org/message/AFSNJ7XHVTC52RSRX2GBQFF3VEEAY2MS
- https://lists.fedoraproject.org/archives/list/package-announce@lists.fedoraproject.org/message/UFH5DDMU5TZ3JT4Q52WMRAHACA5MHIMT