CVE-2020-25698

HighCVSS 7.5/10Last modified Jun 17, 2026

Description

Users' enrollment capabilities were not being sufficiently checked in Moodle when they are restored into an existing course. This could lead to them unenrolling users without having permission to do so. Versions affected: 3.5 to 3.5.14, 3.7 to 3.7.8, 3.8 to 3.8.5, 3.9 to 3.9.2 and earlier unsupported versions. Fixed in 3.9.3, 3.8.6, 3.7.9, 3.5.15, and 3.10.

Metrics

CVSS 3.1 7.5/10CVSS:3.1/AV:N/AC:L/PR:N/UI:N/S:U/C:N/I:H/A:N

Weakness enumeration

CWE-284

Affected software

No affected versions have been published.

Timeline

Published: Nov 19, 2020
Last modified: Jun 17, 2026
NVD status: Modified

Related CVEs from 2020

CVE-2020-256997.5In moodle, insufficient capability checks could lead to users with the ability to course restore adding additional capabilities to roles wit CVE-2020-25705.9Vulnerability in the MySQL Client product of Oracle MySQL (component: C API). Supported versions that are affected are 5.7.28 and prior and CVE-2020-257006.5In moodle, some database module web services allowed students to add entries within groups they did not belong to. Versions affected: 3.9 to CVE-2020-257015.3If the upload course tool in Moodle was used to delete an enrollment method which did not exist or was not already enabled, the tool would e CVE-2020-257026.1In Moodle, it was possible to include JavaScript when re-naming content bank items. Versions affected: 3.9 to 3.9.2. This is fixed in moodle CVE-2020-257035.3The participants table download in Moodle always included user emails, but should have only done so when users' emails are not hidden. Versi CVE-2020-257045.5A flaw memory leak in the Linux kernel performance monitoring subsystem was found in the way if using PERF_EVENT_IOC_SET_FILTER. A local use CVE-2020-257057.4A flaw in ICMP packets in the Linux kernel may allow an attacker to quickly scan open UDP ports. This flaw allows an off-path remote attacke CVE-2020-257066.1A cross-site scripting (XSS) vulnerability exists in templates_import.php (Cacti 1.2.13) due to Improper escaping of error message during te CVE-2020-257087.5A divide by zero issue was found to occur in libvncserver-0.9.12. A malicious client could use this flaw to send a specially crafted message CVE-2020-257097.5A flaw was found in OpenLDAP. This flaw allows an attacker who can send a malicious packet to be processed by OpenLDAP’s slapd server, to tr CVE-2020-25713.3Vulnerability in the Oracle VM Server for SPARC product of Oracle Systems (component: Templates). The supported version that is affected is