CVE-2020-25629: 
PHP vulnerability analysis and mitigation

A vulnerability was discovered in Moodle (CVE-2020-25629) where users with 'Log in as' capability in a course context, typically course managers, could gain unauthorized access to site administration capabilities by logging in as a System manager. The vulnerability affected Moodle versions 3.9 to 3.9.1, 3.8 to 3.8.4, 3.7 to 3.7.7, 3.5 to 3.5.13, and earlier unsupported versions. This security issue was fixed in versions 3.9.2, 3.8.5, 3.7.8, and 3.5.14 (Moodle Advisory).

The vulnerability is classified as a Missing Authorization (CWE-862) and Improper Access Control (CWE-284) issue. It received a CVSS v3.1 base score of 8.8 (HIGH) with the vector string CVSS:3.1/AV:N/AC:L/PR:L/UI:N/S:U/C:H/I:H/A:H, indicating network accessibility, low attack complexity, and high impact on confidentiality, integrity, and availability (NVD).

The vulnerability allowed course managers to escalate their privileges by exploiting the 'Log in as' functionality to gain access to site administration capabilities that should only be available to System managers. This could lead to unauthorized access to sensitive system configurations and administrative functions (Moodle Advisory).

The vulnerability could be exploited by users who had the 'Log in as' capability in a course context, which is typically assigned to course managers. The attack vector required the attacker to have legitimate access to the course management role (NVD).

As a temporary workaround, administrators were advised to remove the 'Login as other users' capability from the manager role until the patch could be applied. The permanent fix was implemented in versions 3.9.2, 3.8.5, 3.7.8, and 3.5.14 (Moodle Advisory).