CVE-2020-25698

HighCVSS 7.5/10Last modified Jun 17, 2026

Description

Users' enrollment capabilities were not being sufficiently checked in Moodle when they are restored into an existing course. This could lead to them unenrolling users without having permission to do so. Versions affected: 3.5 to 3.5.14, 3.7 to 3.7.8, 3.8 to 3.8.5, 3.9 to 3.9.2 and earlier unsupported versions. Fixed in 3.9.3, 3.8.6, 3.7.9, 3.5.15, and 3.10.

Metrics

CVSS 3.1 7.5/10CVSS:3.1/AV:N/AC:L/PR:N/UI:N/S:U/C:N/I:H/A:N

Weakness enumeration

CWE-284

Affected software

VendorProductVersions
n/amoodleFixed in 3.9.3; Fixed in 3.8.6; Fixed in 3.7.9; Fixed in 3.5.15; Fixed in 3.10

References

Timeline

Published
Nov 19, 2020
Last modified
Jun 17, 2026
NVD status
Modified

Related CVEs from 2020

CVE-2020-256997.5In moodle, insufficient capability checks could lead to users with the ability to course restore adding additional capabilities to roles witCVE-2020-25705.9Vulnerability in the MySQL Client product of Oracle MySQL (component: C API). Supported versions that are affected are 5.7.28 and prior and CVE-2020-257006.5In moodle, some database module web services allowed students to add entries within groups they did not belong to. Versions affected: 3.9 toCVE-2020-257015.3If the upload course tool in Moodle was used to delete an enrollment method which did not exist or was not already enabled, the tool would eCVE-2020-257026.1In Moodle, it was possible to include JavaScript when re-naming content bank items. Versions affected: 3.9 to 3.9.2. This is fixed in moodleCVE-2020-257035.3The participants table download in Moodle always included user emails, but should have only done so when users' emails are not hidden. VersiCVE-2020-257045.5A flaw memory leak in the Linux kernel performance monitoring subsystem was found in the way if using PERF_EVENT_IOC_SET_FILTER. A local useCVE-2020-257057.4A flaw in ICMP packets in the Linux kernel may allow an attacker to quickly scan open UDP ports. This flaw allows an off-path remote attackeCVE-2020-257066.1A cross-site scripting (XSS) vulnerability exists in templates_import.php (Cacti 1.2.13) due to Improper escaping of error message during teCVE-2020-257087.5A divide by zero issue was found to occur in libvncserver-0.9.12. A malicious client could use this flaw to send a specially crafted messageCVE-2020-257097.5A flaw was found in OpenLDAP. This flaw allows an attacker who can send a malicious packet to be processed by OpenLDAP’s slapd server, to trCVE-2020-25713.3Vulnerability in the Oracle VM Server for SPARC product of Oracle Systems (component: Templates). The supported version that is affected is