Description
In moodle, some database module web services allowed students to add entries within groups they did not belong to. Versions affected: 3.9 to 3.9.2, 3.8 to 3.8.5, 3.7 to 3.7.8, 3.5 to 3.5.14 and earlier unsupported versions. This is fixed in moodle 3.8.6, 3.7.9, 3.5.15, and 3.10.
Remediation
References
Related Vulnerabilities
WordPress Plugin Convert Plus Security Bypass (3.4.4)
WordPress Plugin Banner Effect Header Cross-Site Scripting (1.2.7)
PHP CVE-2008-2051 Vulnerability (CVE-2008-2051)
Magento XML Injection (aka Blind XPath Injection) Vulnerability (CVE-2019-8158)
MediaWiki Missing Authentication for Critical Function Vulnerability (CVE-2019-12468)