CVE-2020-25701: Medium severity moodle vulnerability
If the upload course tool in Moodle was used to delete an enrollment method which did not exist or was not already enabled, the tool would erroneously enable that enrollment method. This could lead to unintended users gaining access to the course. Versions affected: 3.9 to 3.9.2, 3.8 to 3.8.5, 3.7 to 3.7.8, 3.5 to 3.5.14 and earlier unsupported versions. This is fixed in moodle 3.9.3, 3.8.6, 3.7.9, 3.5.15, and 3.10.
Other sources
If the upload course tool was used to delete an enrolment method which did not exist or was not already enabled, the tool would erroneously enable that enrolment method. This could lead to unintended users gaining access to the course.
Versions affected: 3.9 to 3.9.2, 3.8 to 3.8.5, 3.7 to 3.7.8, 3.5 to 3.5.14 and earlier unsupported versions
— Red Hat
Affected Software
Event History
Frequently Asked Questions
What is the severity of CVE-2020-25701?
The severity of CVE-2020-25701 is considered moderate due to the potential for unauthorized access to courses.
How do I fix CVE-2020-25701?
To fix CVE-2020-25701, upgrade Moodle to version 3.5.15, 3.7.9, 3.8.6, or 3.9.3 or later.
Which Moodle versions are affected by CVE-2020-25701?
Moodle versions affected by CVE-2020-25701 include 3.9 to 3.9.2, 3.8 to 3.8.5, and 3.7 to 3.7.6.
What kind of exploit does CVE-2020-25701 represent?
CVE-2020-25701 represents a vulnerability that could allow unintended users access to courses via erroneous enrollment method enabling.
Is there a workaround for CVE-2020-25701?
There is no documented workaround for CVE-2020-25701; the recommended action is to apply the appropriate software update.