CVE-2020-1754: Medium severity Moodle moodle vulnerability
In Moodle before 3.8.2, 3.7.5, 3.6.9 and 3.5.11, users viewing the grade history report without the 'access all groups' capability were not restricted to viewing grades of users within their own groups.
Affected Software
Remediation
Recommended actions to resolve this vulnerability, in priority order.
- Upgrade
Upgrade
Moodleto a version that resolves this vulnerability.Fixed in 3.8.2 - Upgrade
Upgrade
Moodleto a version that resolves this vulnerability.Fixed in 3.7.5 - Upgrade
Upgrade
Moodleto a version that resolves this vulnerability.Fixed in 3.6.9 - Upgrade
Upgrade
Moodleto a version that resolves this vulnerability.Fixed in 3.5.11
Event History
Frequently Asked Questions
What is the severity of CVE-2020-1754?
The severity of CVE-2020-1754 is medium with a severity value of 4.3.
Which versions of Moodle are affected by CVE-2020-1754?
Moodle versions 3.5.0 to 3.5.11, 3.6.0 to 3.6.9, 3.7.0 to 3.7.5, 3.8.0, and 3.8.1 are all affected by CVE-2020-1754.
What is the impact of CVE-2020-1754?
CVE-2020-1754 allows users without the 'access all groups' capability to view grade history reports of users outside their own groups.
How can I fix CVE-2020-1754?
To fix CVE-2020-1754, update your Moodle installation to version 3.8.2, 3.7.5, 3.6.9, or 3.5.11.
Where can I find more information about CVE-2020-1754?
More information about CVE-2020-1754 can be found at the following link: https://moodle.org/mod/forum/discuss.php?d=398350