CVE-2020-25701: 
PHP vulnerability analysis and mitigation

CVE-2020-25701 is a vulnerability discovered in Moodle's upload course tool that could lead to unauthorized course access. When the tool was used to delete an enrollment method that didn't exist or wasn't already enabled, it would erroneously enable that enrollment method. This vulnerability affected Moodle versions 3.9 to 3.9.2, 3.8 to 3.8.5, 3.7 to 3.7.8, 3.5 to 3.5.14 and earlier unsupported versions. The issue was discovered by Víctor Déniz Falcón and was fixed in Moodle versions 3.9.3, 3.8.6, 3.7.9, 3.5.15, and 3.10 (Moodle Forum).

The vulnerability is classified as an incorrect authorization issue (CWE-863) with a CVSS v3.1 Base Score of 5.3 (Medium). The attack vector is network-based (AV:N), requires low attack complexity (AC:L), needs no privileges (PR:N), requires no user interaction (UI:N), has unchanged scope (S:U), with no impact on confidentiality (C:N), low impact on integrity (I:L), and no impact on availability (A:N) (NVD).

The vulnerability could lead to unintended users gaining access to courses by exploiting the incorrect behavior of the upload course tool when handling enrollment method deletions. This could potentially compromise course access controls and allow unauthorized access to course content (Moodle Forum).

The vulnerability requires access to the upload course tool functionality. While no known exploits have been reported in the wild, the risk is considered minor according to Moodle's security assessment (Moodle Forum).

Until the patch is applied, administrators should ensure any enrollment method deletions are only performed on courses where that enrollment method already exists and is enabled. The permanent fix is to upgrade to Moodle versions 3.9.3, 3.8.6, 3.7.9, 3.5.15, or 3.10 (Moodle Forum).