« Volver al listado

CVE-2020-25698

Estado: ModificadaAlta (7.5)—

Unas capacidades de inscripción de los usuarios no estaban suficientemente comprobadas en Moodle cuando son restauradas en un curso existente. Esto podría conllevar a cancelar la inscripción de usuarios sin tener permiso para hacerlo. Versiones afectadas: 3.5 a 3.5.14, 3.7 a 3.7.8, 3.8 a 3.8.5, 3.9 a 3.9.2 y versiones anteriores no compatibles. Corregido en 3.9.3, 3.8.6, 3.7.9, 3.5.15 y 3.10

CVSS

Probabilidad de explotación (EPSS)

EPSS (Exploit Prediction Scoring System, de FIRST) estima la probabilidad de que una vulnerabilidad sea explotada en 30 días. Complementa a CVSS (impacto) y a CISA KEV (explotación confirmada).

Tecnologías afectadas (2)

Fedoraproject — FedoraMoodle — Moodle

CWE

Referencias

JSON original (NVD)

Mostrar
{
  "id": "CVE-2020-25698",
  "cveTags": [],
  "metrics": {
    "cvssMetricV2": [
      {
        "type": "Primary",
        "source": "nvd@nist.gov",
        "cvssData": {
          "version": "2.0",
          "baseScore": 5,
          "accessVector": "NETWORK",
          "vectorString": "AV:N/AC:L/Au:N/C:N/I:P/A:N",
          "authentication": "NONE",
          "integrityImpact": "PARTIAL",
          "accessComplexity": "LOW",
          "availabilityImpact": "NONE",
          "confidentialityImpact": "NONE"
        },
        "acInsufInfo": false,
        "impactScore": 2.9,
        "baseSeverity": "MEDIUM",
        "obtainAllPrivilege": false,
        "exploitabilityScore": 10,
        "obtainUserPrivilege": false,
        "obtainOtherPrivilege": false,
        "userInteractionRequired": false
      }
    ],
    "cvssMetricV31": [
      {
        "type": "Primary",
        "source": "nvd@nist.gov",
        "cvssData": {
          "scope": "UNCHANGED",
          "version": "3.1",
          "baseScore": 7.5,
          "attackVector": "NETWORK",
          "baseSeverity": "HIGH",
          "vectorString": "CVSS:3.1/AV:N/AC:L/PR:N/UI:N/S:U/C:N/I:H/A:N",
          "integrityImpact": "HIGH",
          "userInteraction": "NONE",
          "attackComplexity": "LOW",
          "availabilityImpact": "NONE",
          "privilegesRequired": "NONE",
          "confidentialityImpact": "NONE"
        },
        "impactScore": 3.6,
        "exploitabilityScore": 3.9
      }
    ]
  },
  "affected": [
    {
      "source": "secalert@redhat.com",
      "affectedData": [
        {
          "vendor": "n/a",
          "product": "moodle",
          "versions": [
            {
              "status": "affected",
              "version": "Fixed in 3.9.3"
            },
            {
              "status": "affected",
              "version": "Fixed in 3.8.6"
            },
            {
              "status": "affected",
              "version": "Fixed in 3.7.9"
            },
            {
              "status": "affected",
              "version": "Fixed in 3.5.15"
            },
            {
              "status": "affected",
              "version": "Fixed in 3.10"
            }
          ]
        }
      ]
    }
  ],
  "published": "2020-11-19T17:15:12.560",
  "references": [
    {
      "url": "https://bugzilla.redhat.com/show_bug.cgi?id=1895419",
      "tags": [
        "Issue Tracking",
        "Vendor Advisory"
      ],
      "source": "secalert@redhat.com"
    },
    {
      "url": "https://lists.fedoraproject.org/archives/list/package-announce%40lists.fedoraproject.org/message/4NNFCHPPHRJNJROIX6SYMHOC6HMKP3GU/",
      "source": "secalert@redhat.com"
    },
    {
      "url": "https://lists.fedoraproject.org/archives/list/package-announce%40lists.fedoraproject.org/message/B55KXBVAT45MDASJ3EK6VIGQOYGJ4NH6/",
      "source": "secalert@redhat.com"
    },
    {
      "url": "https://moodle.org/mod/forum/discuss.php?d=413935",
      "tags": [
        "Vendor Advisory"
      ],
      "source": "secalert@redhat.com"
    },
    {
      "url": "https://bugzilla.redhat.com/show_bug.cgi?id=1895419",
      "tags": [
        "Issue Tracking",
        "Vendor Advisory"
      ],
      "source": "af854a3a-2127-422b-91ae-364da2661108"
    },
    {
      "url": "https://lists.fedoraproject.org/archives/list/package-announce%40lists.fedoraproject.org/message/4NNFCHPPHRJNJROIX6SYMHOC6HMKP3GU/",
      "source": "af854a3a-2127-422b-91ae-364da2661108"
    },
    {
      "url": "https://lists.fedoraproject.org/archives/list/package-announce%40lists.fedoraproject.org/message/B55KXBVAT45MDASJ3EK6VIGQOYGJ4NH6/",
      "source": "af854a3a-2127-422b-91ae-364da2661108"
    },
    {
      "url": "https://moodle.org/mod/forum/discuss.php?d=413935",
      "tags": [
        "Vendor Advisory"
      ],
      "source": "af854a3a-2127-422b-91ae-364da2661108"
    }
  ],
  "vulnStatus": "Modified",
  "weaknesses": [
    {
      "type": "Secondary",
      "source": "secalert@redhat.com",
      "description": [
        {
          "lang": "en",
          "value": "CWE-284"
        }
      ]
    },
    {
      "type": "Primary",
      "source": "nvd@nist.gov",
      "description": [
        {
          "lang": "en",
          "value": "NVD-CWE-noinfo"
        }
      ]
    }
  ],
  "descriptions": [
    {
      "lang": "en",
      "value": "Users' enrollment capabilities were not being sufficiently checked in Moodle when they are restored into an existing course. This could lead to them unenrolling users without having permission to do so. Versions affected: 3.5 to 3.5.14, 3.7 to 3.7.8, 3.8 to 3.8.5, 3.9 to 3.9.2 and earlier unsupported versions. Fixed in 3.9.3, 3.8.6, 3.7.9, 3.5.15, and 3.10."
    },
    {
      "lang": "es",
      "value": "Unas capacidades de inscripción de los usuarios no estaban suficientemente comprobadas en Moodle cuando son restauradas en un curso existente. Esto podría conllevar a cancelar la inscripción de usuarios sin tener permiso para hacerlo. Versiones afectadas: 3.5 a 3.5.14, 3.7 a 3.7.8, 3.8 a 3.8.5, 3.9 a 3.9.2 y versiones anteriores no compatibles. Corregido en 3.9.3, 3.8.6, 3.7.9, 3.5.15 y 3.10"
    }
  ],
  "lastModified": "2026-06-17T03:07:09.030",
  "configurations": [
    {
      "nodes": [
        {
          "negate": false,
          "cpeMatch": [
            {
              "criteria": "cpe:2.3:a:moodle:moodle:*:*:*:*:*:*:*:*",
              "vulnerable": true,
              "matchCriteriaId": "21060F03-55D0-4CE6-8053-B43BFB45878F",
              "versionEndIncluding": "3.5.14",
              "versionStartIncluding": "3.5.0"
            },
            {
              "criteria": "cpe:2.3:a:moodle:moodle:*:*:*:*:*:*:*:*",
              "vulnerable": true,
              "matchCriteriaId": "25E3D7A8-AC8B-4D18-9DED-C0CA738FB11B",
              "versionEndIncluding": "3.7.8",
              "versionStartIncluding": "3.7.0"
            },
            {
              "criteria": "cpe:2.3:a:moodle:moodle:*:*:*:*:*:*:*:*",
              "vulnerable": true,
              "matchCriteriaId": "39CCCF23-223B-41F8-B9DE-EA9D9CAC2EF8",
              "versionEndIncluding": "3.8.5",
              "versionStartIncluding": "3.8.0"
            },
            {
              "criteria": "cpe:2.3:a:moodle:moodle:*:*:*:*:*:*:*:*",
              "vulnerable": true,
              "matchCriteriaId": "409326C7-5C0B-40A4-9EDC-1AF76B5F8E94",
              "versionEndIncluding": "3.9.2",
              "versionStartIncluding": "3.9.0"
            }
          ],
          "operator": "OR"
        }
      ]
    },
    {
      "nodes": [
        {
          "negate": false,
          "cpeMatch": [
            {
              "criteria": "cpe:2.3:o:fedoraproject:fedora:32:*:*:*:*:*:*:*",
              "vulnerable": true,
              "matchCriteriaId": "36D96259-24BD-44E2-96D9-78CE1D41F956"
            },
            {
              "criteria": "cpe:2.3:o:fedoraproject:fedora:33:*:*:*:*:*:*:*",
              "vulnerable": true,
              "matchCriteriaId": "E460AA51-FCDA-46B9-AE97-E6676AA5E194"
            }
          ],
          "operator": "OR"
        }
      ]
    }
  ],
  "sourceIdentifier": "secalert@redhat.com"
}