Improper access control in moodle
Priority LOW 37CWE-284Published · Updated
Key facts
- Attack vector
- Network
- Privileges required
- None
- User interaction
- None
- Attack complexity
- Low
- Impact type
- Security bypass
- Confidentiality · integrity · availability
- None · High · None
- Fix status
- Fixed
Attack profile from CVSS 3.1 · NVD. Fix status from CNA and GitHub. Impact type from CWE-284.
Summary
Users' enrollment capabilities were not being sufficiently checked in Moodle when they are restored into an existing course. This could lead to them unenrolling users without having permission to do so. Versions affected: 3.5 to 3.5.14, 3.7 to 3.7.8, 3.8 to 3.8.5, 3.9 to 3.9.2 and earlier unsupported versions. Fixed in 3.9.3, 3.8.6, 3.7.9, 3.5.15, and 3.10.
Why it matters now
EPSS 0.01918 80th percentileScored 2026-11-07
Fix Fixed moodle/moodle (Packagist): 3.9.3, 3.8.6, 3.7.9 +1
SSVC decision points
Not available: CISA has not published SSVC decision points for this record.
Affected products
| Vendor | Product | Affected versions | Fixed in | Status | Source |
|---|---|---|---|---|---|
| — | moodle | Fixed in 3.9.3; Fixed in 3.8.6; Fixed in 3.7.9; Fixed in 3.5.15; Fixed in 3.10 | — | No fix listed | CNA |
| — | moodle/moodle (Packagist) | 3.9.0 to before 3.9.3 | 3.9.3 | Patch available | GHSA-vxhx-gmhm-623c |
| — | moodle/moodle (Packagist) | 3.8.0 to before 3.8.6 | 3.8.6 | Patch available | GHSA-vxhx-gmhm-623c |
| — | moodle/moodle (Packagist) | 3.7.0 to before 3.7.9 | 3.7.9 | Patch available | GHSA-vxhx-gmhm-623c |
| — | moodle/moodle (Packagist) | 3.5 to before 3.5.15 | 3.5.15 | Patch available | GHSA-vxhx-gmhm-623c |
- moodle Vendor— Affected Fixed in 3.9.3; Fixed in 3.8.6; Fixed in 3.7.9; Fixed in 3.5.15; Fixed in 3.10 Fixed in — No fix listed CNA
- moodle/moodle (Packagist) Vendor— Affected 3.9.0 to before 3.9.3 Fixed in 3.9.3 Patch available GHSA-vxhx-gmhm-623c
- moodle/moodle (Packagist) Vendor— Affected 3.8.0 to before 3.8.6 Fixed in 3.8.6 Patch available GHSA-vxhx-gmhm-623c
- moodle/moodle (Packagist) Vendor— Affected 3.7.0 to before 3.7.9 Fixed in 3.7.9 Patch available GHSA-vxhx-gmhm-623c
- moodle/moodle (Packagist) Vendor— Affected 3.5 to before 3.5.15 Fixed in 3.5.15 Patch available GHSA-vxhx-gmhm-623c
CPE configurations NVD · 3
| CPE | Versions | Role | Vendor |
|---|---|---|---|
| cpe:2.3:a:moodle:moodle:*:*:*:*:*:*:*:* | 3.5.0 – 3.5.14; 3.7.0 – 3.7.8; 3.8.0 – 3.8.5; 3.9.0 – 3.9.2 | Vulnerable | Moodle |
| cpe:2.3:o:fedoraproject:fedora:32:*:*:*:*:*:*:* | 32 | Vulnerable | Fedoraproject |
| cpe:2.3:o:fedoraproject:fedora:33:*:*:*:*:*:*:* | 33 | Vulnerable | Fedoraproject |
- cpe:2.3:a:moodle:moodle:*:*:*:*:*:*:*:* Versions 3.5.0 – 3.5.14; 3.7.0 – 3.7.8; 3.8.0 – 3.8.5; 3.9.0 – 3.9.2 Vulnerable ·Moodle
- cpe:2.3:o:fedoraproject:fedora:32:*:*:*:*:*:*:* Versions 32 Vulnerable ·Fedoraproject
- cpe:2.3:o:fedoraproject:fedora:33:*:*:*:*:*:*:* Versions 33 Vulnerable ·Fedoraproject
Remediation
- Fix · GHSA-vxhx-gmhm-623c moodle/moodle (Packagist) Fixed in 3.9.3 Advisory →
- Fix · GHSA-vxhx-gmhm-623c moodle/moodle (Packagist) Fixed in 3.8.6 Advisory →
- Fix · GHSA-vxhx-gmhm-623c moodle/moodle (Packagist) Fixed in 3.7.9 Advisory →
- Fix · GHSA-vxhx-gmhm-623c moodle/moodle (Packagist) Fixed in 3.5.15 Advisory →
Fixed in the same release
Records fixed by the same vendor advisory or release, as the CNA lists them.
- Advisory ·
moodle — FEDORA-2020-db73e37548
6 records Highest priority Priority LOW 6 LOW
Other records, highest priority first
- TI-2020-15715 Incorrect authorization in moodlePriority LOW 36
- TI-2020-15716 SQL injection in moodlePriority LOW 32
- TI-2020-15718 Cross-site scripting in moodlePriority LOW 30
- Advisory ·
moodle — FEDORA-2020-304aa2c365
6 records Highest priority Priority LOW 6 LOW
Other records, highest priority first
- TI-2020-15715 Incorrect authorization in moodlePriority LOW 36
- TI-2020-15716 SQL injection in moodlePriority LOW 32
- TI-2020-15718 Cross-site scripting in moodlePriority LOW 30
Vendor assessments
Timeline
- 2026-10-02 Threatist record created from CVE-2020-25698
- 2026-10-03 Alias added: GHSA-vxhx-gmhm-623c
References
Advisory 5
Other 4
- https://github.com/moodle/moodle/commit/c8ac07fb50fa92eee1d574823fbda09e1b309a63
- https://git.moodle.org/gw?p=moodle.git&a=search&h=HEAD&st=commit&s=MDL-67837
- https://lists.fedoraproject.org/archives/list/[email protected]/message/4NNFCHPPHRJNJROIX6SYMHOC6HMKP3GU
- https://lists.fedoraproject.org/archives/list/[email protected]/message/B55KXBVAT45MDASJ3EK6VIGQOYGJ4NH6
Sources
- CVE-2020-25698 · CVE Program
- CVE-2020-25698 · NVD
- FIRST EPSS
- GHSA-vxhx-gmhm-623c · GitHub Advisory Database · CC BY 4.0
- CVE-2020-25698 · Red Hat security data · CC BY 4.0
This product uses the NVD API but is not endorsed or certified by the NVD. Sources and licences