| Vulnerability Name: | CVE-2010-1616 (CCN-57552) | ||||||||||||||||||||||||
| Assigned: | 2010-04-06 | ||||||||||||||||||||||||
| Published: | 2010-04-06 | ||||||||||||||||||||||||
| Updated: | 2020-12-01 | ||||||||||||||||||||||||
| Summary: | Moodle 1.8.x and 1.9.x before 1.9.8 can create new roles when restoring a course, which allows teachers to create new accounts even if they do not have the moodle/user:create capability. | ||||||||||||||||||||||||
| CVSS v3 Severity: | 5.3 Medium (CCN CVSS v3.1 Vector: CVSS:3.1/AV:N/AC:L/PR:N/UI:N/S:U/C:N/I:L/A:N)
| ||||||||||||||||||||||||
| CVSS v2 Severity: | 4.0 Medium (CVSS v2 Vector: AV:N/AC:L/Au:S/C:N/I:P/A:N) 3.0 Low (Temporal CVSS v2 Vector: AV:N/AC:L/Au:S/C:N/I:P/A:N/E:U/RL:OF/RC:C)
3.2 Low (CCN Temporal CVSS v2 Vector: AV:N/AC:M/Au:N/C:N/I:P/A:N/E:U/RL:OF/RC:C)
| ||||||||||||||||||||||||
| Vulnerability Type: | CWE-Other | ||||||||||||||||||||||||
| Vulnerability Consequences: | Other | ||||||||||||||||||||||||
| References: | Source: MITRE Type: CNA CVE-2010-1616 Source: SUSE Type: UNKNOWN SUSE-SR:2010:011 Source: CCN Type: MSA-10-0004 Improved access control in course restore Source: CONFIRM Type: UNKNOWN http://moodle.org/security/ Source: MISC Type: UNKNOWN http://tracker.moodle.org/browse/MDL-16658 Source: DEBIAN Type: DSA-2115 moodle -- several vulnerabilities Source: CCN Type: OSVDB ID: 64318 Moodle moodle/user:create Permission Weakness Course Restoration New Account Creation Source: CCN Type: BID-39150 Moodle Prior to 1.9.8/1.8.12 Multiple Vulnerabilities Source: VUPEN Type: UNKNOWN ADV-2010-1107 Source: XF Type: UNKNOWN moodle-courserestore-weak-security(57552) Source: SUSE Type: SUSE-SR:2010:011 SUSE Security Summary Report | ||||||||||||||||||||||||
| Vulnerable Configuration: | Configuration 1: Configuration CCN 1:  Denotes that component is vulnerable | ||||||||||||||||||||||||
| Oval Definitions | |||||||||||||||||||||||||
| |||||||||||||||||||||||||
| BACK | |||||||||||||||||||||||||