Description
If the upload course tool in Moodle was used to delete an enrollment method which did not exist or was not already enabled, the tool would erroneously enable that enrollment method. This could lead to unintended users gaining access to the course. Versions affected: 3.9 to 3.9.2, 3.8 to 3.8.5, 3.7 to 3.7.8, 3.5 to 3.5.14 and earlier unsupported versions. This is fixed in moodle 3.9.3, 3.8.6, 3.7.9, 3.5.15, and 3.10.
Affected products
| Vendor | Product | Affected | Fixed |
|---|---|---|---|
| — | moodle | Fixed in 3.9.3, Fixed in 3.8.6, Fixed in 3.7.9, Fixed in 3.5.15, Fixed in 3.10 | — |
Fixed in Linux distributions
Distributions backport fixes, so the version that fixes this vulnerability differs per release — upgrade to at least the version shown. From the distributions' security trackers and advisories.
Ubuntu
Security tracker ↗| Release | Package | Fixed in | Advisory |
|---|---|---|---|
| Ubuntu Pro 18.04 LTS | moodle | No fix yet | — |
| Ubuntu Pro 16.04 LTS | moodle | No fix yet | — |
Affected packages
| Ecosystem | Package | Affected | Fixed | Record |
|---|---|---|---|---|
| Packagist | moodle/moodle | >= 3.9.0, < 3.9.3 | 3.9.3 | GHSA-c9hq-g4q8-w893 |
| Packagist | moodle/moodle | >= 3.8.0, < 3.8.6 | 3.8.6 | GHSA-c9hq-g4q8-w893 |
| Packagist | moodle/moodle | >= 3.7.0, < 3.7.9 | 3.7.9 | GHSA-c9hq-g4q8-w893 |
| Packagist | moodle/moodle | >= 3.5, < 3.5.15 | 3.5.15 | GHSA-c9hq-g4q8-w893 |