Advisory details:
github_osv / GHSA-9q29-jcjw-fw7h
| Advisory ID | github_osv/GHSA-9q29-jcjw-fw7h |
| Aliases |
CVE-2020-14321
|
| Summary | Moodle Incorrect Authorization vulnerability In Moodle before 3.9.1, 3.8.4, 3.7.7 and 3.5.13, teachers of a course were able to assign themselves the manager role within that course. |
| Status | Published |
| Exploitability | 2.0 |
| Weighted Severity | 7.9 |
| Risk | 10.0 |
| Affected and Fixed Packages | Package Details |
| Introduced and Fixed Package Commit Patches | Package Commit Patches Details |
| CWE-863 | Incorrect Authorization |
| System | Score | Found at |
|---|---|---|
| cvssv3.1 | 8.8 | https://github.com/github/advisory-database/blob/main/advisories/github-reviewed/2022/08/GHSA-9q29-jcjw-fw7h/GHSA-9q29-jcjw-fw7h.json |
| generic_textual | HIGH |
| Data source | Metasploit |
|---|---|
| Description | Moodle version 3.9, 3.8 to 3.8.3, 3.7 to 3.7.6, 3.5 to 3.5.12 and earlier unsupported versions allow for a teacher to exploit chain to RCE. A bug in the privileges system allows a teacher to add themselves as a manager to their own class. They can then add any other users, and thus look to add someone with manager privileges on the system (not just the class). After adding a system manager, a 'loginas' feature is used to access their account. Next the system is reconfigured to allow for all users to install an addon/plugin. Then a malicious theme is uploaded and creates an RCE. If all of that is a success, we revert permissions for managers to system default and remove our malicoius theme. Manual cleanup to remove students from the class is required. This module was tested against Moodle version 3.9 |
| Note | Stability: - crash-safe Reliability: - repeatable-session SideEffects: - config-changes - ioc-in-logs |
| Ransomware campaign use | Unknown |
| Source publication date | July 20, 2020 |
| Platform | PHP |
| Source URL | https://github.com/rapid7/metasploit-framework/tree/master/modules/exploits/multi/http/moodle_teacher_enrollment_priv_esc_to_rce.rb |
No EPSS data available for this advisory.
| Patch URL | |
|---|---|
| There are no known patches. | |
| Attack Vector (AV) | Attack Complexity (AC) | Privileges Required (PR) | User Interaction (UI) | Scope (S) | Confidentiality Impact (C) | Integrity Impact (I) | Availability Impact (A) |
|---|---|---|---|---|---|---|---|
network adjacent_network local physical |
low high |
none low high |
none required |
unchanged changed |
high low none |
high low none |
high low none |
There are no SSVC decisions available.