CVE-2021-20283
EUVD-2022-200915.03.2021, 22:15
The web service responsible for fetching other users' enrolled courses did not validate that the requesting user had permission to view that information in each course in moodle before 3.10.2, 3.9.5, 3.8.8, 3.5.17.Enginsight
Affected Products (NVD)
| Vendor | Product | Version |
|---|---|---|
| moodle | moodle | 3.5.0 ≤ 𝑥 < 3.5.17 |
| moodle | moodle | 3.8.0 ≤ 𝑥 < 3.8.8 |
| moodle | moodle | 3.9.0 ≤ 𝑥 < 3.9.5 |
| moodle | moodle | 3.10.0 ≤ 𝑥 < 3.10.2 |
𝑥
= Vulnerable software versions
Ubuntu Releases
Common Weakness Enumeration
- CWE-863 - Incorrect AuthorizationThe software performs an authorization check when an actor attempts to access a resource or perform an action, but it does not correctly perform the check. This allows attackers to bypass intended access restrictions.
- CWE-862 - Missing AuthorizationThe software does not perform an authorization check when an actor attempts to access a resource or perform an action.
References