Moodle is vulnerable to unauthorized new accounts creation
Moderate severity
GitHub Reviewed
Published
May 13, 2022
to the GitHub Advisory Database
•
Updated Feb 7, 2024
Package
Affected versions
>= 1.8.0, < 1.8.12
>= 1.9.0, < 1.9.8
Patched versions
1.8.12
1.9.8
Description
Published by the National Vulnerability Database
Apr 29, 2010
Published to the GitHub Advisory Database
May 13, 2022
Reviewed
Feb 7, 2024
Last updated
Feb 7, 2024
Moodle 1.8.x and 1.9.x before 1.9.8 can create new roles when restoring a course, which allows teachers to create new accounts even if they do not have the moodle/user:create capability.
References