Description

Moodle 1.8.x and 1.9.x before 1.9.8 can create new roles when restoring a course, which allows teachers to create new accounts even if they do not have the moodle/user:create capability.

Remediation

References

CVE-2010-1616

Related Vulnerabilities

WordPress CVE-2016-5837 Vulnerability (CVE-2016-5837)

WordPress Plugin Keep Backup Daily Cross-Site Scripting (2.0.2)

WordPress Plugin WordPress Poll Multiple SQL Injection and Security Bypass Vulnerabilities (34.04)

IBM RTC Improper Neutralization of Input During Web Page Generation ('Cross-site Scripting') Vulnerability (CVE-2018-1761)

Drupal Other Vulnerability (CVE-2006-1226)

Severity

Medium

Classification

CVE-2010-1616

Tags

Missing Update Known Vulnerabilities