CVE-2020-14321

In Moodle before 3.9.1, 3.8.4, 3.7.7 and 3.5.13, teachers of a course were able to assign themselves the manager role within that course.

CVSS v3 8.8 HIGH

8.8^/10

CVSS v3 : HIGH

Vector :

Exploitability : 2.8 / Impact : 5.9

Attack Vector NETWORK

Attack Complexity LOW

Privileges Required LOW

User Interaction NONE

Confidentiality Impact HIGH

Integrity Impact HIGH

Availability Impact HIGH

Scope UNCHANGED

References

Link	Resource
https://moodle.org/mod/forum/discuss.php?d=407393	Patch Vendor Advisory
https://moodle.org/mod/forum/discuss.php?d=407393	Patch Vendor Advisory

Configurations

Configuration 1 (hide)

OR	cpe:2.3:a:moodle:moodle::::::::
	cpe:2.3:a:moodle:moodle::::::::
	cpe:2.3:a:moodle:moodle::::::::
	cpe:2.3:a:moodle:moodle:3.9.0:-::::::

History

21 Nov 2024, 05:03

Type	Values Removed	Values Added
References	~~() https://moodle.org/mod/forum/discuss.php?d=407393 - Patch, Vendor Advisory~~	() https://moodle.org/mod/forum/discuss.php?d=407393 - Patch, Vendor Advisory

17 Aug 2022, 15:19

Type	Values Removed	Values Added
CVSS	v2 : ~~unknown~~ v3 : ~~unknown~~	v2 : unknown v3 : 8.8
CPE		cpe:2.3:a:moodle:moodle:::::::: cpe:2.3:a:moodle:moodle:3.9.0:-::::::
References	~~(MISC) https://moodle.org/mod/forum/discuss.php?d=407393 -~~	(MISC) https://moodle.org/mod/forum/discuss.php?d=407393 - Patch, Vendor Advisory
CWE		CWE-863

16 Aug 2022, 21:15

Type	Values Removed	Values Added
New CVE

Information

Published : 2022-08-16 21:15

Updated : 2024-11-21 05:03

NVD link : CVE-2020-14321

Mitre link : CVE-2020-14321

CVE.ORG link : CVE-2020-14321

JSON object : View

Products Affected

moodle

moodle

CWE

CWE-863

Incorrect Authorization

{"id": "CVE-2020-14321", "metrics": {"cvssMetricV31": [{"type": "Primary", "source": "nvd@nist.gov", "cvssData": {"scope": "UNCHANGED", "version": "3.1", "baseScore": 8.8, "attackVector": "NETWORK", "baseSeverity": "HIGH", "vectorString": "CVSS:3.1/AV:N/AC:L/PR:L/UI:N/S:U/C:H/I:H/A:H", "integrityImpact": "HIGH", "userInteraction": "NONE", "attackComplexity": "LOW", "availabilityImpact": "HIGH", "privilegesRequired": "LOW", "confidentialityImpact": "HIGH"}, "impactScore": 5.9, "exploitabilityScore": 2.8}]}, "published": "2022-08-16T21:15:09.447", "references": [{"url": "https://moodle.org/mod/forum/discuss.php?d=407393", "tags": ["Patch", "Vendor Advisory"], "source": "secalert@redhat.com"}, {"url": "https://moodle.org/mod/forum/discuss.php?d=407393", "tags": ["Patch", "Vendor Advisory"], "source": "af854a3a-2127-422b-91ae-364da2661108"}], "vulnStatus": "Modified", "weaknesses": [{"type": "Secondary", "source": "secalert@redhat.com", "description": [{"lang": "en", "value": "CWE-863"}]}, {"type": "Primary", "source": "nvd@nist.gov", "description": [{"lang": "en", "value": "CWE-863"}]}], "descriptions": [{"lang": "en", "value": "In Moodle before 3.9.1, 3.8.4, 3.7.7 and 3.5.13, teachers of a course were able to assign themselves the manager role within that course."}, {"lang": "es", "value": "En Moodle versiones anteriores a 3.9.1, 3.8.4, 3.7.7 y 3.5.13, los profesores de un curso pod\u00edan asignarse a s\u00ed mismos el rol de administrador dentro de ese curso."}], "lastModified": "2024-11-21T05:03:00.277", "configurations": [{"nodes": [{"negate": false, "cpeMatch": [{"criteria": "cpe:2.3:a:moodle:moodle:*:*:*:*:*:*:*:*", "vulnerable": true, "matchCriteriaId": "B4E4791F-5A61-4733-A1DF-12A44ECD4C39", "versionEndExcluding": "3.5.13", "versionStartIncluding": "3.5.0"}, {"criteria": "cpe:2.3:a:moodle:moodle:*:*:*:*:*:*:*:*", "vulnerable": true, "matchCriteriaId": "CAC673F7-1C86-4AA4-B7AD-0FFD1D4E34F9", "versionEndExcluding": "3.7.7", "versionStartIncluding": "3.7.0"}, {"criteria": "cpe:2.3:a:moodle:moodle:*:*:*:*:*:*:*:*", "vulnerable": true, "matchCriteriaId": "15E2163C-5835-49D3-AB1F-5F9915EC564B", "versionEndExcluding": "3.8.4", "versionStartIncluding": "3.8.0"}, {"criteria": "cpe:2.3:a:moodle:moodle:3.9.0:-:*:*:*:*:*:*", "vulnerable": true, "matchCriteriaId": "8CF8FCAA-948F-430E-A19D-C7BC09DA7D74"}], "operator": "OR"}]}], "sourceIdentifier": "secalert@redhat.com"}