GHSA-9q29-jcjw-fw7hHighCVSS 8.8

Moodle Incorrect Authorization vulnerability

Published
August 17, 2022
Last Modified
May 8, 2025

🔗 CVE IDs covered (1)

CVE-2020-14321 →

📋 Description

In Moodle before 3.9.1, 3.8.4, 3.7.7 and 3.5.13, teachers of a course were able to assign themselves the manager role within that course.

🎯 Affected products4

  • composer/moodle/moodle:>= 3.9.0-beta, < 3.9.1
  • composer/moodle/moodle:>= 3.8.0-beta, < 3.8.4
  • composer/moodle/moodle:>= 3.6.0-beta, < 3.7.7
  • composer/moodle/moodle:< 3.5.13

🔗 References (4)