CVE-2020-1754

Published: Aug 5, 2022Modified: Nov 21, 2024

4.3

Vector

CVSS:3.1/AV:N/AC:L/PR:L/UI:N/S:U/C:L/I:N/A:N

Exploitability: 2.8 / Impact: 1.4

Source: NVD

Description

In Moodle before 3.8.2, 3.7.5, 3.6.9 and 3.5.11, users viewing the grade history report without the 'access all groups' capability were not restricted to viewing grades of users within their own groups.

Affected (5)

Products: Moodle: Moodle

Moodle

1 product

Moodle

Configuration A

5 vulnerable

Vulnerable Software	Affected Versions
Moodle Moodle	From 3.5.0 to 3.5.11
Moodle Moodle	From 3.6.0 to 3.6.9
Moodle Moodle	From 3.7.0 to 3.7.5
Moodle Moodle	Version 3.8.0
Moodle Moodle	Version 3.8.1

Related CWEs

CWE-284

Improper Access Control

The product does not restrict or incorrectly restricts access to a resource from an unauthorized actor.

CWE-732

Incorrect Permission Assignment for Critical Resource

The product specifies permissions for a security-critical resource in a way that allows that resource to be read or modified by unintended actors.

References (2)

https://moodle.org/mod/forum/discuss.php?d=398350

Source: secalert@redhat.com

Issue TrackingPatchVendor Advisory

https://moodle.org/mod/forum/discuss.php?d=398350

Source: af854a3a-2127-422b-91ae-364da2661108

Issue TrackingPatchVendor Advisory

Timeline

No history available yet.