CVE-2020-14321
Moodle Teacher Enrollment Privilege Escalation / Remote Code Execution
Severity Score
8.8
*CVSS v3.1
Exploit Likelihood
*EPSS
Affected Versions
*CPE
Public Exploits
3
*Multiple Sources
Exploited in Wild
-
*KEV
Decision
-
*SSVC
Descriptions
In Moodle before 3.9.1, 3.8.4, 3.7.7 and 3.5.13, teachers of a course were able to assign themselves the manager role within that course.
En Moodle versiones anteriores a 3.9.1, 3.8.4, 3.7.7 y 3.5.13, los profesores de un curso podían asignarse a sí mismos el rol de administrador dentro de ese curso.
*Credits:
N/A
CVSS Scores
Attack Vector
Attack Complexity
Privileges Required
User Interaction
Scope
Confidentiality
Integrity
Availability
* Common Vulnerability Scoring System
SSVC
- Decision:-
Exploitation
Automatable
Tech. Impact
* Organization's Worst-case Scenario
Timeline
- 2020-06-17 CVE Reserved
- 2021-06-20 First Exploit
- 2021-10-12 CVE Published
- 2024-08-04 CVE Updated
- 2024-10-23 EPSS Updated
- ---------- Exploited in Wild
- ---------- KEV Due Date
CWE
- CWE-863: Incorrect Authorization
CAPEC
References (4)
| URL | Tag | Source |
|---|
| URL | Date | SRC |
|---|---|---|
| https://github.com/HoangKien1020/CVE-2020-14321 | 2021-06-20 | |
| https://github.com/lanzt/CVE-2020-14321 | 2021-12-03 | |
| https://github.com/f0ns1/CVE-2020-14321-modified-exploit | 2022-02-01 |
| URL | Date | SRC |
|---|---|---|
| https://moodle.org/mod/forum/discuss.php?d=407393 | 2020-07-20 |
| URL | Date | SRC |
|---|
Affected Vendors, Products, and Versions
| Vendor | Product | Version | Other | Status | ||||||
|---|---|---|---|---|---|---|---|---|---|---|
| Vendor | Product | Version | Other | Status | <-- --> | Vendor | Product | Version | Other | Status |
| Moodle Search vendor "Moodle" | Moodle Search vendor "Moodle" for product "Moodle" | >= 3.5.0 < 3.5.13 Search vendor "Moodle" for product "Moodle" and version " >= 3.5.0 < 3.5.13" | - |
Affected
| ||||||
| Moodle Search vendor "Moodle" | Moodle Search vendor "Moodle" for product "Moodle" | >= 3.7.0 < 3.7.7 Search vendor "Moodle" for product "Moodle" and version " >= 3.7.0 < 3.7.7" | - |
Affected
| ||||||
| Moodle Search vendor "Moodle" | Moodle Search vendor "Moodle" for product "Moodle" | >= 3.8.0 < 3.8.4 Search vendor "Moodle" for product "Moodle" and version " >= 3.8.0 < 3.8.4" | - |
Affected
| ||||||
| Moodle Search vendor "Moodle" | Moodle Search vendor "Moodle" for product "Moodle" | 3.9.0 Search vendor "Moodle" for product "Moodle" and version "3.9.0" | - |
Affected
| ||||||