CVE-2020-25698 -------------- Users' enrollment capabilities were not being sufficiently checked in Moodle when they are restored into an existing course. This could lead to them unenrolling users without having permission to do so. Versions affected: 3.5 to 3.5.14, 3.7 to 3.7.8, 3.8 to 3.8.5, 3.9 to 3.9.2 and earlier unsupported versions. Fixed in 3.9.3, 3.8.6, 3.7.9, 3.5.15, and 3.10. Links: https://bugzilla.redhat.com/show_bug.cgi?id=1895419 https://moodle.org/mod/forum/discuss.php?d=413935 CVE-2020-25699 -------------- In moodle, insufficient capability checks could lead to users with the ability to course restore adding additional capabilities to roles within that course. Versions affected: 3.9 to 3.9.2, 3.8 to 3.8.5, 3.7 to 3.7.8, 3.5 to 3.5.14 and earlier unsupported versions. This is fixed in moodle 3.9.3, 3.8.6, 3.7.9, 3.5.15, and 3.10. Links: https://bugzilla.redhat.com/show_bug.cgi?id=1895425 https://moodle.org/mod/forum/discuss.php?d=413936 CVE-2020-25700 -------------- In moodle, some database module web services allowed students to add entries within groups they did not belong to. Versions affected: 3.9 to 3.9.2, 3.8 to 3.8.5, 3.7 to 3.7.8, 3.5 to 3.5.14 and earlier unsupported versions. This is fixed in moodle 3.8.6, 3.7.9, 3.5.15, and 3.10. Links: https://bugzilla.redhat.com/show_bug.cgi?id=1895427 https://moodle.org/mod/forum/discuss.php?d=413938 CVE-2020-25701 -------------- If the upload course tool in Moodle was used to delete an enrollment method which did not exist or was not already enabled, the tool would erroneously enable that enrollment method. This could lead to unintended users gaining access to the course. Versions affected: 3.9 to 3.9.2, 3.8 to 3.8.5, 3.7 to 3.7.8, 3.5 to 3.5.14 and earlier unsupported versions. This is fixed in moodle 3.9.3, 3.8.6, 3.7.9, 3.5.15, and 3.10. Links: https://bugzilla.redhat.com/show_bug.cgi?id=1895432 https://moodle.org/mod/forum/discuss.php?d=413939 CVE-2020-25702 -------------- In Moodle, it was possible to include JavaScript when re-naming content bank items. Versions affected: 3.9 to 3.9.2. This is fixed in moodle 3.9.3 and 3.10. Links: https://bugzilla.redhat.com/show_bug.cgi?id=1895437 https://moodle.org/mod/forum/discuss.php?d=413940 CVE-2020-25703 -------------- The participants table download in Moodle always included user emails, but should have only done so when users' emails are not hidden. Versions affected: 3.9 to 3.9.2, 3.8 to 3.8.5 and 3.7 to 3.7.8. This is fixed in moodle 3.9.3, 3.8.6, 3.7.9, and 3.10. Links: https://bugzilla.redhat.com/show_bug.cgi?id=1895439 https://moodle.org/mod/forum/discuss.php?d=413941
The latest releases are on the tree. All the affected versions are off.
(In reply to Anthony Basile from comment #1) > The latest releases are on the tree. All the affected versions are off. thank you anthony! that was really quick :)
