CVE-2020-1754

MediumCVSS 4.3/10Last modified Jun 23, 2026

Description

In Moodle before 3.8.2, 3.7.5, 3.6.9 and 3.5.11, users viewing the grade history report without the 'access all groups' capability were not restricted to viewing grades of users within their own groups.

Metrics

CVSS 3.1 4.3/10CVSS:3.1/AV:N/AC:L/PR:L/UI:N/S:U/C:L/I:N/A:N

Weakness enumeration

CWE-284 CWE-732

Affected software

Vendor	Product	Versions
n/a	Moodle	3.8.2, 3.7.5, 3.6.9 and 3.5.11

References

https://moodle.org/mod/forum/discuss.php?d=398350Issue Tracking, Patch, Vendor Advisory
https://moodle.org/mod/forum/discuss.php?d=398350Issue Tracking, Patch, Vendor Advisory

Timeline

Published: Aug 5, 2022
Last modified: Jun 23, 2026
NVD status: Modified

Related CVEs from 2020

CVE-2020-175418.8Libjpeg-turbo all version have a stack-based buffer overflow in the "transform" component. A remote attacker can send a malformed jpeg file CVE-2020-175425.4Cross Site Scripting (XSS) in dotCMS v5.1.5 allows remote attackers to execute arbitrary code by injecting a malicious payload into the "Tas CVE-2020-17555.3In Moodle before 3.8.2, 3.7.5, 3.6.9 and 3.5.11, X-Forwarded-For headers could be used to spoof a user's IP, in order to bypass remote addre CVE-2020-175514.8ImpressCMS 1.4.0 is affected by XSS in modules/system/admin.php which may result in arbitrary remote code execution.CVE-2020-17567.2In Moodle before 3.8.2, 3.7.5, 3.6.9 and 3.5.11, insufficient input escaping was applied to the PHP unit webrunner admin tool.CVE-2020-175639.1Path Traversal in FeiFeiCMS v4.0 allows remote attackers to delete arbitrary files by sending a crafted HTTP request to " /index.php?s=/admi CVE-2020-175649.1Path Traversal in FeiFeiCMS v4.0 allows remote attackers to delete arbitrary files by sending a crafted HTTP request to the " Admin/DataActi CVE-2020-17578.1A flaw was found in all undertow-2.x.x SP1 versions prior to undertow-2.0.30.SP1, all undertow-1.x.x and undertow-2.x.x versions prior to un CVE-2020-17585.9A flaw was found in Keycloak in versions before 10.0.0, where it does not perform the TLS hostname verification while sending emails using t CVE-2020-17596.8A vulnerability was found in Red Hat Ceph Storage 4 and Red Hat Openshift Container Storage 4.2 where, A nonce reuse vulnerability was disco CVE-2020-17606.1A flaw was found in the Ceph Object Gateway, where it supports request sent by an anonymous user in Amazon S3. This flaw could lead to poten CVE-2020-17616.1A flaw was found in the OpenShift web console, where the access token is stored in the browser's local storage. An attacker can use this fla