Amanda Doughty

**Name of the Vulnerable Software and Affected Versions** Moodle versions prior to 2.4.11 Moodle versions 2.5.x prior to 2.5.8 Moodle versions 2.6.x prior to 2.6.5 Moodle versions 2.7.x prior to 2.7.2 **Description** The issue allows remote authenticated users to bypass the individual answer-posting requirement and discover an author's username by leveraging the student role and visiting a Q&A forum. This is achieved through the `forum print latest discussions` function in `mod/forum/lib.php`. **Recommendations** For Moodle versions prior to 2.4.11, update to version 2.4.11 or later. For Moodle versions 2.5.x prior to 2.5.8, update to version 2.5.8 or later. For Moodle versions 2.6.x prior to 2.6.5, update to version 2.6.5 or later. For Moodle versions 2.7.x prior to 2.7.2, update to version 2.7.2 or later.

**Name of the Vulnerable Software and Affected Versions** Moodle versions 2.0.x through 2.0.8 Moodle versions 2.1.x through 2.1.5 Moodle versions 2.2.x through 2.2.2 **Description** The issue allows remote authenticated users to bypass an activity's read-only state and modify the database by leveraging the student role and editing database activity entries that already exist. **Recommendations** For Moodle versions 2.0.x through 2.0.8, update to version 2.0.9 or later. For Moodle versions 2.1.x through 2.1.5, update to version 2.1.6 or later. For Moodle versions 2.2.x through 2.2.2, update to version 2.2.3 or later.