CVE Catalog
CVE-2020-1754
MediumCVSS 4.3Exploitation Probability (EPSS)
Low risk0.54%
41th percentile - higher than 41% of all known CVEs
Summary
In Moodle before versions 3.8.2, 3.7.5, 3.6.9, and 3.5.11, users viewing the grade history report without the 'access all groups' capability were not restricted to viewing grades of users within their own groups.
Risk Assessment
This may lead to unauthorized access to other users' grade data, violating privacy and information security.
Recommendation
It is recommended to update Moodle to the latest version to mitigate this security vulnerability.
Original NVD description (English source)
In Moodle before 3.8.2, 3.7.5, 3.6.9 and 3.5.11, users viewing the grade history report without the 'access all groups' capability were not restricted to viewing grades of users within their own groups.