MSA-22-0006: Users with moodle/site:uploadusers but without moodle/user:delete could delete users

by Michael Hawkins.  

Insufficient capability checks could allow users with the moodle/site:uploadusers capability to delete users, without having the necessary moodle/user:delete capability.


Severity/Risk:Minor
Versions affected:3.11 to 3.11.5, 3.10 to 3.10.9, 3.9 to 3.9.12 and earlier unsupported versions
Versions fixed:3.11.6, 3.10.10 and 3.9.13
Reported by:Chris Pratt
Workaround:Remove the moodle/site:uploadusers capability from users who do not also have the moodle/user:delete capability, until the patch is applied.
CVE identifier:CVE-2022-0985
Changes (master):http://git.moodle.org/gw?p=moodle.git&a=search&h=HEAD&st=commit&s=MDL-72972
Tracker issue:MDL-72972 Users with moodle/site:uploadusers but without moodle/user:delete could delete users

Read more https://moodle.org/mod/forum/discuss.php?d=432948&parent=1742074