CVE-2020-1756: Input Validation
Published Aug 16, 2022
·Updated
In Moodle before 3.8.2, 3.7.5, 3.6.9 and 3.5.11, insufficient input escaping was applied to the PHP unit webrunner admin tool.
Affected Software
4 affected components
Moodle moodle>=3.5.0<3.5.11
Moodle moodle>=3.6.0<3.6.9
Moodle moodle>=3.7.0<3.7.5
Moodle moodle>=3.8.0<3.8.2
Remediation
Patch Available
Event History
Aug 16, 2022
CVE Published
via MITRE·07:30 PM
Data Sourced
via MITRE·07:30 PM
DescriptionWeakness
Frequently Asked Questions
1
What is the vulnerability ID for this Moodle vulnerability?
The vulnerability ID for this Moodle vulnerability is CVE-2020-1756.
2
What is the severity rating of CVE-2020-1756?
CVE-2020-1756 has a severity rating of 7.2 (high).
3
Which versions of Moodle are affected by CVE-2020-1756?
Moodle versions 3.5.0 to 3.5.11, 3.6.0 to 3.6.9, 3.7.0 to 3.7.5, and 3.8.0 to 3.8.2 are affected by CVE-2020-1756.
4
What is the description of CVE-2020-1756?
In Moodle before 3.8.2, 3.7.5, 3.6.9, and 3.5.11, insufficient input escaping was applied to the PHP unit webrunner admin tool.
5
How can I fix CVE-2020-1756 in Moodle?
To fix CVE-2020-1756, you should upgrade to Moodle versions 3.5.12, 3.6.10, 3.7.6, or 3.8.3 or apply the patches provided by Moodle.