Security readout for executives and security teams
Plain-English summary
A logged-in Moodle user who could view the grade history report might see grade records for users outside their assigned groups. The issue is limited to confidentiality of grade data, not system takeover or data modification.
Executive priority
Prioritize remediation for education, training, or customer portals where grades are sensitive personal data. The technical severity is medium, but privacy exposure can create business and regulatory impact.
Technical view
CVE-2020-1754 is an access-control flaw in Moodle grade history reporting before fixed releases 3.8.2, 3.7.5, 3.6.9, and 3.5.11. Users without the 'access all groups' capability were not restricted to grades within their own groups. CVSS 3.1 score is 4.3.
Likely exposure
Exposure is most relevant to Moodle sites using group-based course separation and grade history reporting. Risk depends on whether lower-privileged authenticated users can access that report.
Exploitation context
The provided sources do not show known active exploitation, and CISA KEV status is false. Exploitation requires an authenticated user with grade history report access, so this is primarily an internal privacy and compliance concern.
Researcher notes
Mapped weakness is CWE-284. The CVSS vector indicates network access, low attack complexity, low privileges required, no user interaction, unchanged scope, and confidentiality impact only. Sources do not provide exploit details or broader affected products.
Mitigation direction
- Upgrade affected Moodle branches to the listed fixed versions or later supported releases.
- Review Moodle vendor guidance for any branch-specific remediation notes.
- Restrict grade history report access to trusted roles only.
- Review group and role permissions for users lacking 'access all groups'.
- Assess whether exposed grade data triggers privacy notification obligations.
Validation and detection
- Inventory Moodle versions across production, staging, and managed hosting environments.
- Confirm sites are on 3.8.2, 3.7.5, 3.6.9, 3.5.11, or later supported versions.
- Review roles allowed to view the grade history report.
- Verify users without 'access all groups' see only their assigned group data.
- Check audit logs for unusual grade history report access where available.
Public sources used
Generated from the cited source records. This long-tail analysis has not been individually reviewed by a named human.
Conservative CVE-to-ATT&CK context
These mappings and lookup hints may be relevant to the vulnerability behavior, CWE, affected product, or exposure path. Glexia-inferred context is not an official MITRE, ATT&CK, CWE, or CVE Program mapping.
ATT&CK lookup starting points
Use these exact CWE pages and searches to review the Glexia ATT&CK library from this CVE's weakness and description context.
CWE-284: Authorization and privilege behavior lookup
Authorization weaknesses can support privilege escalation and valid-account review, depending on exploit path. Open the exact CWE lookup page first, then review the ATT&CK searches from that MITRE weakness context. This is a Glexia lookup hint, not an official ATT&CK mapping.
Open ATT&CK lookupCVE-2020-1754 mapping review
Open the CVE-to-ATT&CK bridge for reviewed, inferred, or future official mappings tied to this CVE.
Open ATT&CK lookup- Severity
- Medium
- CVSS
- 4.3 (3.1)
- Known Exploited
- No
- Published
Vector: CVSS:3.1/AV:N/AC:L/PR:L/UI:N/S:U/C:L/I:N/A:N
CNA and ADP enrichment extracted from CVE v5
These fields come from the CVE record and ADP containers, not from Glexia's Take. They preserve time-varying source decisions such as CISA SSVC, KEV status, CVSS metrics, and provider references.
SSVC decision data
CVSS vector scores
1 official scoreWe collect every scored CVSS vector available in the official CNA and ADP containers. When more than one version is present, the table keeps the source vectors side by side instead of collapsing them into the highest score.
CVSS:3.1/AV:N/AC:L/PR:L/UI:N/S:U/C:L/I:N/A:N2.81.4CISA-ADPVulnerability scoring details
Base CVSS 3.1 score
4.3MediumVector: CVSS:3.1/AV:N/AC:L/PR:L/UI:N/S:U/C:L/I:N/A:N
Vulnerability timeline
Timeline events are normalized from CVE metadata, CNA source timelines, ADP timelines, and KEV metadata when present.
- CVE reservedCVE Program
The CVE ID was reserved by the assigning CNA.
- CVE publishedCVE Program
The CVE record was published.
- CVE updatedCVE Program
The CVE record metadata indicates this as the latest update time.
ADP provider summaries
Source materials
- CVE List V5 sourceCVE List V5
- https://moodle.org/mod/forum/discuss.php?d=398350CVE reference, redhat · x_refsource_MISC
Products and packages named in the record
CWE details
CWE links open Glexia weakness intelligence pages with official CWE context, developer remediation guidance, and related CVE mappings.
Improper Access Control
Improper Access Control represents a recurring weakness pattern that can create exploitable paths when design, validation, or implementation controls are missing.