Vulnerability Details : CVE-2020-14321

Public exploit exists!
In Moodle before 3.9.1, 3.8.4, 3.7.7 and 3.5.13, teachers of a course were able to assign themselves the manager role within that course.
Published 2022-08-16 21:15:09
Updated 2022-12-08 03:19:53
Source Red Hat, Inc.
View at NVD,   CVE.org

Products affected by CVE-2020-14321

Exploit prediction scoring system (EPSS) score for CVE-2020-14321

EPSS FAQ
12.21%
Probability of exploitation activity in the next 30 days EPSS Score History
~ 96 %
Percentile, the proportion of vulnerabilities that are scored at or less

Metasploit modules for CVE-2020-14321

  • Moodle Teacher Enrollment Privilege Escalation to RCE
    Disclosure Date: 2020-07-20
    First seen: 2022-12-23
    exploit/multi/http/moodle_teacher_enrollment_priv_esc_to_rce
    Moodle version 3.9, 3.8 to 3.8.3, 3.7 to 3.7.6, 3.5 to 3.5.12 and earlier unsupported versions allow for a teacher to exploit chain to RCE. A bug in the privileges system allows a teacher to add themselves as a manager to their own class. They can then add any other u

CVSS scores for CVE-2020-14321

Base Score Base Severity CVSS Vector Exploitability Score Impact Score Score Source First Seen
8.8
 HIGH CVSS:3.1/AV:N/AC:L/PR:L/UI:N/S:U/C:H/I:H/A:H
2.8
5.9
 NIST

CWE ids for CVE-2020-14321

  • The product performs an authorization check when an actor attempts to access a resource or perform an action, but it does not correctly perform the check.
    Assigned by:
    • nvd@nist.gov (Primary)
    • secalert@redhat.com (Secondary)

References for CVE-2020-14321

Jump to
This web site uses cookies for managing your session, storing preferences, website analytics and additional purposes described in our privacy policy.
By using this web site you are agreeing to CVEdetails.com terms of use!
Accept Close