CVE-2021-20283

MEDIUM

moodle 3.5.0-3.5.16 and 3.10.0-3.10.1 - Missing Authorization in Course Enrollment Web Service

Title source: llm

Description

The web service responsible for fetching other users' enrolled courses did not validate that the requesting user had permission to view that information in each course in moodle before 3.10.2, 3.9.5, 3.8.8, 3.5.17.

References (4)

Core 4

Core References

Issue Tracking, Third Party Advisory x_refsource_misc

https://bugzilla.redhat.com/show_bug.cgi?id=1939051

Patch, Vendor Advisory x_refsource_misc

https://moodle.org/mod/forum/discuss.php?d=419654

Mailing List, Third Party Advisory vendor-advisory x_refsource_fedora

https://lists.fedoraproject.org/archives/list/package-announce%40lists.fedoraproject.org/message/AFSNJ7XHVTC52RSRX2GBQFF3VEEAY2MS/

Mailing List, Third Party Advisory vendor-advisory x_refsource_fedora

https://lists.fedoraproject.org/archives/list/package-announce%40lists.fedoraproject.org/message/UFH5DDMU5TZ3JT4Q52WMRAHACA5MHIMT/

Scores

CVSS v3 4.3

EPSS 0.0015

EPSS Percentile 35.5%

Attack Vector NETWORK

CVSS:3.1/AV:N/AC:L/PR:L/UI:N/S:U/C:L/I:N/A:N

Details

CWE

CWE-862 CWE-863

Status published

Products (4)

fedoraproject/fedora 32

fedoraproject/fedora 34

moodle/moodle 3.10.0 - 3.10.2Packagist

moodle/moodle 3.5.0 - 3.5.17

Published Mar 15, 2021

Tracked Since Feb 18, 2026