From a15c7929f4c452024bffa75d7dbb866268668a6d Mon Sep 17 00:00:00 2001
From: "advisory-database[bot]"
 <45398580+advisory-database[bot]@users.noreply.github.com>
Date: Tue, 23 Apr 2024 23:35:52 +0000
Subject: [PATCH] Publish Advisories

GHSA-2m72-m5cw-3g9h
GHSA-2m72-m5cw-3g9h
---
 .../GHSA-2m72-m5cw-3g9h.json                  | 131 ++++++++++++++++++
 .../GHSA-2m72-m5cw-3g9h.json                  |  51 -------
 2 files changed, 131 insertions(+), 51 deletions(-)
 create mode 100644 advisories/github-reviewed/2022/05/GHSA-2m72-m5cw-3g9h/GHSA-2m72-m5cw-3g9h.json
 delete mode 100644 advisories/unreviewed/2022/05/GHSA-2m72-m5cw-3g9h/GHSA-2m72-m5cw-3g9h.json

diff --git a/advisories/github-reviewed/2022/05/GHSA-2m72-m5cw-3g9h/GHSA-2m72-m5cw-3g9h.json b/advisories/github-reviewed/2022/05/GHSA-2m72-m5cw-3g9h/GHSA-2m72-m5cw-3g9h.json
new file mode 100644
index 00000000000..afc5cd750c7
--- /dev/null
+++ b/advisories/github-reviewed/2022/05/GHSA-2m72-m5cw-3g9h/GHSA-2m72-m5cw-3g9h.json
@@ -0,0 +1,131 @@
+{
+  "schema_version": "1.4.0",
+  "id": "GHSA-2m72-m5cw-3g9h",
+  "modified": "2024-04-23T23:34:29Z",
+  "published": "2022-05-24T17:44:37Z",
+  "aliases": [
+    "CVE-2021-20283"
+  ],
+  "summary": "Missing permission check in Moodle",
+  "details": "The web service responsible for fetching other users' enrolled courses did not validate that the requesting user had permission to view that information in each course in moodle before 3.10.2, 3.9.5, 3.8.8, 3.5.17.",
+  "severity": [
+    {
+      "type": "CVSS_V3",
+      "score": "CVSS:3.1/AV:N/AC:L/PR:L/UI:N/S:U/C:L/I:N/A:N"
+    }
+  ],
+  "affected": [
+    {
+      "package": {
+        "ecosystem": "Packagist",
+        "name": "moodle/moodle"
+      },
+      "ranges": [
+        {
+          "type": "ECOSYSTEM",
+          "events": [
+            {
+              "introduced": "3.10.0"
+            },
+            {
+              "fixed": "3.10.2"
+            }
+          ]
+        }
+      ]
+    },
+    {
+      "package": {
+        "ecosystem": "Packagist",
+        "name": "moodle/moodle"
+      },
+      "ranges": [
+        {
+          "type": "ECOSYSTEM",
+          "events": [
+            {
+              "introduced": "3.9.0"
+            },
+            {
+              "fixed": "3.9.5"
+            }
+          ]
+        }
+      ]
+    },
+    {
+      "package": {
+        "ecosystem": "Packagist",
+        "name": "moodle/moodle"
+      },
+      "ranges": [
+        {
+          "type": "ECOSYSTEM",
+          "events": [
+            {
+              "introduced": "3.8.0"
+            },
+            {
+              "fixed": "3.8.8"
+            }
+          ]
+        }
+      ]
+    },
+    {
+      "package": {
+        "ecosystem": "Packagist",
+        "name": "moodle/moodle"
+      },
+      "ranges": [
+        {
+          "type": "ECOSYSTEM",
+          "events": [
+            {
+              "introduced": "0"
+            },
+            {
+              "fixed": "3.5.17"
+            }
+          ]
+        }
+      ]
+    }
+  ],
+  "references": [
+    {
+      "type": "ADVISORY",
+      "url": "https://nvd.nist.gov/vuln/detail/CVE-2021-20283"
+    },
+    {
+      "type": "WEB",
+      "url": "https://bugzilla.redhat.com/show_bug.cgi?id=1939051"
+    },
+    {
+      "type": "PACKAGE",
+      "url": "https://github.com/moodle/moodle"
+    },
+    {
+      "type": "WEB",
+      "url": "https://lists.fedoraproject.org/archives/list/package-announce@lists.fedoraproject.org/message/AFSNJ7XHVTC52RSRX2GBQFF3VEEAY2MS"
+    },
+    {
+      "type": "WEB",
+      "url": "https://lists.fedoraproject.org/archives/list/package-announce@lists.fedoraproject.org/message/UFH5DDMU5TZ3JT4Q52WMRAHACA5MHIMT"
+    },
+    {
+      "type": "WEB",
+      "url": "https://moodle.org/mod/forum/discuss.php?d=419654"
+    }
+  ],
+  "database_specific": {
+    "cwe_ids": [
+      "CWE-862",
+      "CWE-863"
+    ],
+    "severity": "MODERATE",
+    "github_reviewed": true,
+    "github_reviewed_at": "2024-04-23T23:34:29Z",
+    "nvd_published_at": "2021-03-15T22:15:00Z"
+  }
+}
\ No newline at end of file
diff --git a/advisories/unreviewed/2022/05/GHSA-2m72-m5cw-3g9h/GHSA-2m72-m5cw-3g9h.json b/advisories/unreviewed/2022/05/GHSA-2m72-m5cw-3g9h/GHSA-2m72-m5cw-3g9h.json
deleted file mode 100644
index 848ead1aa5c..00000000000
--- a/advisories/unreviewed/2022/05/GHSA-2m72-m5cw-3g9h/GHSA-2m72-m5cw-3g9h.json
+++ /dev/null
@@ -1,51 +0,0 @@
-{
-  "schema_version": "1.4.0",
-  "id": "GHSA-2m72-m5cw-3g9h",
-  "modified": "2022-08-06T00:00:39Z",
-  "published": "2022-05-24T17:44:37Z",
-  "aliases": [
-    "CVE-2021-20283"
-  ],
-  "details": "The web service responsible for fetching other users' enrolled courses did not validate that the requesting user had permission to view that information in each course in moodle before 3.10.2, 3.9.5, 3.8.8, 3.5.17.",
-  "severity": [
-    {
-      "type": "CVSS_V3",
-      "score": "CVSS:3.1/AV:N/AC:L/PR:L/UI:N/S:U/C:L/I:N/A:N"
-    }
-  ],
-  "affected": [
-
-  ],
-  "references": [
-    {
-      "type": "ADVISORY",
-      "url": "https://nvd.nist.gov/vuln/detail/CVE-2021-20283"
-    },
-    {
-      "type": "WEB",
-      "url": "https://bugzilla.redhat.com/show_bug.cgi?id=1939051"
-    },
-    {
-      "type": "WEB",
-      "url": "https://lists.fedoraproject.org/archives/list/package-announce@lists.fedoraproject.org/message/AFSNJ7XHVTC52RSRX2GBQFF3VEEAY2MS"
-    },
-    {
-      "type": "WEB",
-      "url": "https://lists.fedoraproject.org/archives/list/package-announce@lists.fedoraproject.org/message/UFH5DDMU5TZ3JT4Q52WMRAHACA5MHIMT"
-    },
-    {
-      "type": "WEB",
-      "url": "https://moodle.org/mod/forum/discuss.php?d=419654"
-    }
-  ],
-  "database_specific": {
-    "cwe_ids": [
-      "CWE-862",
-      "CWE-863"
-    ],
-    "severity": "MODERATE",
-    "github_reviewed": false,
-    "github_reviewed_at": null,
-    "nvd_published_at": "2021-03-15T22:15:00Z"
-  }
-}
\ No newline at end of file