---
title: "CVE-2020-25701\n    | Ubuntu"
description: Ubuntu is an open source software operating system that runs from the
  desktop, to the cloud, to all your internet connected things.
url: https://ubuntu.com/security/CVE-2020-25701?format=md
keywords: index, follow
---

# CVE-2020-25701

Publication date 19 November 2020

Last updated 26 August 2025

---

Ubuntu priority

**Medium**

[Why this priority?](https://ubuntu.com/security/cves/about#priority )

## Cvss 3 Severity Score

**5.3 · Medium**

[Score breakdown](https://ubuntu.com/security/CVE-2020-25701?format=md#impact-score)

Toggle side navigation

## Description

If the upload course tool in Moodle was used to delete an enrollment method
which did not exist or was not already enabled, the tool would erroneously
enable that enrollment method. This could lead to unintended users gaining
access to the course. Versions affected: 3.9 to 3.9.2, 3.8 to 3.8.5, 3.7 to
3.7.8, 3.5 to 3.5.14 and earlier unsupported versions. This is fixed in
moodle 3.9.3, 3.8.6, 3.7.9, 3.5.15, and 3.10.

## Status

Show unmaintained releases

| Package | Ubuntu Release | Status |
| --- | --- | --- |
| moodle | 26.04 LTS resolute | Not in release |
| 25.10 questing | Not in release |
| 25.04 plucky | Not in release |
| 24.10 oracular | Not in release |
| 24.04 LTS noble | Not in release |
| 23.10 mantic | Not in release |
| 23.04 lunar | Not in release |
| 22.10 kinetic | Not in release |
| 22.04 LTS jammy | Not in release |
| 21.10 impish | Not in release |
| 21.04 hirsute | Not in release |
| 20.10 groovy | Not in release |
| 20.04 LTS focal | Not in release |
| 18.04 LTS bionic | Needs evaluation |
| 16.04 LTS xenial | Needs evaluation |
| 14.04 LTS trusty | Not in release |

---

* [How can I get the fixes?](https://ubuntu.com/security/cves/about#security)
* [What do statuses mean?](https://ubuntu.com/security/cves/about#statuses)

## Severity score breakdown

CVSS version:
CVSS v3.0

**Base score**

5.3 · Medium

* Base metrics

  | Parameter | Value |
  | --- | --- |
  | Attack vector | Network |
  | Attack complexity | Low |
  | Privileges required | None |
  | User interaction | None |
  | Scope | Unchanged |
  | Confidentiality impact | None |
  | Integrity impact | Low |
  | Availability impact | None |
* Scores

  | Parameter | Value |
  | --- | --- |
  | Base score | 5.3 · Medium |
  | Exploitability score | - |
  | Impact score | - |

**Vector:** CVSS:3.1/AV:N/AC:L/PR:N/UI:N/S:U/C:N/I:L/A:N

## References

* [MITRE](https://cve.mitre.org/cgi-bin/cvename.cgi?name=CVE-2020-25701)
* [NVD](https://nvd.nist.gov/vuln/detail/CVE-2020-25701)
* [Launchpad](https://launchpad.net/bugs/cve/CVE-2020-25701)
* [Debian](https://security-tracker.debian.org/tracker/CVE-2020-25701)

### Other references

* <https://bugzilla.redhat.com/show_bug.cgi?id=1895432>
* <https://moodle.org/mod/forum/discuss.php?d=413939>
* <https://www.cve.org/CVERecord?id=CVE-2020-25701>