Track vulnerabilities like this one.
Sign up free to get alerted when software you use is affected.
5.5
CVE-2011-4285: Moodle 2.0.x: Authenticated Users Can Delete Any Course
CVE-2011-4285 · published 14 years ago
Summary
If you use Moodle 2.0.x, make sure to update to 2.0.2 or later to prevent authenticated users from deleting courses they shouldn't be able to. This could lead to loss of important course data. Update your Moodle installation to the latest version to fix this issue.
What to do
- Update moodle moodle to version 2.0.2.
Affected software
| Ecosystem | Vendor | Product | Affected versions |
|---|---|---|---|
| composer | moodle | moodle |
>= 2.0, < 2.0.2 Fix: upgrade to 2.0.2
|
| – | moodle | moodle |
2.0.0 2.0.1 cpe:2.3:a:moodle:moodle:2.0.0:*:*:*:*:*:*:* |
Original advisory text
The default configuration of Moodle 2.0.x before 2.0.2 has an incorrect setting of the moodle/course:delete capability, which allows remote authenticated users to delete arbitrary courses by levera...
The default configuration of Moodle 2.0.x before 2.0.2 has an incorrect setting of the moodle/course:delete capability, which allows remote authenticated users to delete arbitrary courses by leveraging the teacher role.
References
- https://nvd.nist.gov/vuln/detail/CVE-2011-4285
- http://git.moodle.org/gw?p=moodle.git;a=commit;h=5cfe8aecb8b78e343ded38ba9e7a0a8...
- http://moodle.org/mod/forum/discuss.php?d=170011
- http://openwall.com/lists/oss-security/2011/11/14/1
- https://github.com/moodle/moodle/commit/5dd7e903ff1698dcf2b6bbd821c31720d169fb83
- https://github.com/advisories/GHSA-8vjj-wf73-w882
- http://git.moodle.org/gw?p=moodle.git%3Ba=commit%3Bh=5cfe8aecb8b78e343ded38ba9e7...
Severity
5.5
Medium
Type
CWE-276Incorrect Default Permissions
CWE-264Permissions, Privileges, and Access Controls
Timeline
Published16 Jul 2012
Updated3 Nov 2026
First seen6 Mar 2026
Track software like this
Free during beta