diff --git a/advisories/github-reviewed/2022/05/GHSA-2m72-m5cw-3g9h/GHSA-2m72-m5cw-3g9h.json b/advisories/github-reviewed/2022/05/GHSA-2m72-m5cw-3g9h/GHSA-2m72-m5cw-3g9h.json new file mode 100644 index 00000000000..afc5cd750c7 --- /dev/null +++ b/advisories/github-reviewed/2022/05/GHSA-2m72-m5cw-3g9h/GHSA-2m72-m5cw-3g9h.json @@ -0,0 +1,131 @@ +{ + "schema_version": "1.4.0", + "id": "GHSA-2m72-m5cw-3g9h", + "modified": "2024-04-23T23:34:29Z", + "published": "2022-05-24T17:44:37Z", + "aliases": [ + "CVE-2021-20283" + ], + "summary": "Missing permission check in Moodle", + "details": "The web service responsible for fetching other users' enrolled courses did not validate that the requesting user had permission to view that information in each course in moodle before 3.10.2, 3.9.5, 3.8.8, 3.5.17.", + "severity": [ + { + "type": "CVSS_V3", + "score": "CVSS:3.1/AV:N/AC:L/PR:L/UI:N/S:U/C:L/I:N/A:N" + } + ], + "affected": [ + { + "package": { + "ecosystem": "Packagist", + "name": "moodle/moodle" + }, + "ranges": [ + { + "type": "ECOSYSTEM", + "events": [ + { + "introduced": "3.10.0" + }, + { + "fixed": "3.10.2" + } + ] + } + ] + }, + { + "package": { + "ecosystem": "Packagist", + "name": "moodle/moodle" + }, + "ranges": [ + { + "type": "ECOSYSTEM", + "events": [ + { + "introduced": "3.9.0" + }, + { + "fixed": "3.9.5" + } + ] + } + ] + }, + { + "package": { + "ecosystem": "Packagist", + "name": "moodle/moodle" + }, + "ranges": [ + { + "type": "ECOSYSTEM", + "events": [ + { + "introduced": "3.8.0" + }, + { + "fixed": "3.8.8" + } + ] + } + ] + }, + { + "package": { + "ecosystem": "Packagist", + "name": "moodle/moodle" + }, + "ranges": [ + { + "type": "ECOSYSTEM", + "events": [ + { + "introduced": "0" + }, + { + "fixed": "3.5.17" + } + ] + } + ] + } + ], + "references": [ + { + "type": "ADVISORY", + "url": "https://nvd.nist.gov/vuln/detail/CVE-2021-20283" + }, + { + "type": "WEB", + "url": "https://bugzilla.redhat.com/show_bug.cgi?id=1939051" + }, + { + "type": "PACKAGE", + "url": "https://github.com/moodle/moodle" + }, + { + "type": "WEB", + "url": "https://lists.fedoraproject.org/archives/list/package-announce@lists.fedoraproject.org/message/AFSNJ7XHVTC52RSRX2GBQFF3VEEAY2MS" + }, + { + "type": "WEB", + "url": "https://lists.fedoraproject.org/archives/list/package-announce@lists.fedoraproject.org/message/UFH5DDMU5TZ3JT4Q52WMRAHACA5MHIMT" + }, + { + "type": "WEB", + "url": "https://moodle.org/mod/forum/discuss.php?d=419654" + } + ], + "database_specific": { + "cwe_ids": [ + "CWE-862", + "CWE-863" + ], + "severity": "MODERATE", + "github_reviewed": true, + "github_reviewed_at": "2024-04-23T23:34:29Z", + "nvd_published_at": "2021-03-15T22:15:00Z" + } +} \ No newline at end of file diff --git a/advisories/unreviewed/2022/05/GHSA-2m72-m5cw-3g9h/GHSA-2m72-m5cw-3g9h.json b/advisories/unreviewed/2022/05/GHSA-2m72-m5cw-3g9h/GHSA-2m72-m5cw-3g9h.json deleted file mode 100644 index 848ead1aa5c..00000000000 --- a/advisories/unreviewed/2022/05/GHSA-2m72-m5cw-3g9h/GHSA-2m72-m5cw-3g9h.json +++ /dev/null @@ -1,51 +0,0 @@ -{ - "schema_version": "1.4.0", - "id": "GHSA-2m72-m5cw-3g9h", - "modified": "2022-08-06T00:00:39Z", - "published": "2022-05-24T17:44:37Z", - "aliases": [ - "CVE-2021-20283" - ], - "details": "The web service responsible for fetching other users' enrolled courses did not validate that the requesting user had permission to view that information in each course in moodle before 3.10.2, 3.9.5, 3.8.8, 3.5.17.", - "severity": [ - { - "type": "CVSS_V3", - "score": "CVSS:3.1/AV:N/AC:L/PR:L/UI:N/S:U/C:L/I:N/A:N" - } - ], - "affected": [ - - ], - "references": [ - { - "type": "ADVISORY", - "url": "https://nvd.nist.gov/vuln/detail/CVE-2021-20283" - }, - { - "type": "WEB", - "url": "https://bugzilla.redhat.com/show_bug.cgi?id=1939051" - }, - { - "type": "WEB", - "url": "https://lists.fedoraproject.org/archives/list/package-announce@lists.fedoraproject.org/message/AFSNJ7XHVTC52RSRX2GBQFF3VEEAY2MS" - }, - { - "type": "WEB", - "url": "https://lists.fedoraproject.org/archives/list/package-announce@lists.fedoraproject.org/message/UFH5DDMU5TZ3JT4Q52WMRAHACA5MHIMT" - }, - { - "type": "WEB", - "url": "https://moodle.org/mod/forum/discuss.php?d=419654" - } - ], - "database_specific": { - "cwe_ids": [ - "CWE-862", - "CWE-863" - ], - "severity": "MODERATE", - "github_reviewed": false, - "github_reviewed_at": null, - "nvd_published_at": "2021-03-15T22:15:00Z" - } -} \ No newline at end of file