CVE-2021-20283
15.03.2021, 22:15
The web service responsible for fetching other users' enrolled courses did not validate that the requesting user had permission to view that information in each course in moodle before 3.10.2, 3.9.5, 3.8.8, 3.5.17.Enginsight
| Vendor | Product | Version |
|---|---|---|
| moodle | moodle | 3.5.0 ≤ 𝑥 < 3.5.17 |
| moodle | moodle | 3.8.0 ≤ 𝑥 < 3.8.8 |
| moodle | moodle | 3.9.0 ≤ 𝑥 < 3.9.5 |
| moodle | moodle | 3.10.0 ≤ 𝑥 < 3.10.2 |
𝑥
= Vulnerable software versions
Ubuntu Releases
Common Weakness Enumeration
- CWE-863 - Incorrect AuthorizationThe software performs an authorization check when an actor attempts to access a resource or perform an action, but it does not correctly perform the check. This allows attackers to bypass intended access restrictions.
- CWE-862 - Missing AuthorizationThe software does not perform an authorization check when an actor attempts to access a resource or perform an action.
References