CVE-2021-20283 | BDVDB-2026-150461 Detail
moodle
Description#
The web service responsible for fetching other users' enrolled courses did not validate that the requesting user had permission to view that information in each course in moodle before 3.10.2, 3.9.5, 3.8.8, 3.5.17.
Impact#
No impact statement in the source data.
Weaknesses#
- CWE-863 Incorrect Authorization
References#
- https://bugzilla.redhat.com/show_bug.cgi?id=1939051
- https://moodle.org/mod/forum/discuss.php?d=419654
- https://lists.fedoraproject.org/archives/list/package-announce%40lists.fedoraproject.org/message/AFSNJ7XHVTC52RSRX2GBQFF3VEEAY2MS/
- https://lists.fedoraproject.org/archives/list/package-announce%40lists.fedoraproject.org/message/UFH5DDMU5TZ3JT4Q52WMRAHACA5MHIMT/
Exploit#
No public exploit known
History#
- Version 1Record published in the CVE List.
- Version 2Most recent update recorded in the CVE List.