PT-2014-5391 · Moodle · Moodle

Jakob Ackermann

·

Published

2014-07-29

·

Updated

2022-05-13

·

CVE-2014-3553

CVSS v2.0

4.9

Medium

VectorAV:N/AC:M/Au:S/C:P/I:P/A:N
Name of the Vulnerable Software and Affected Versions Moodle versions 2.3.11 and earlier, 2.4.x before 2.4.11, 2.5.x before 2.5.7, 2.6.x before 2.6.4, 2.7.x before 2.7.1
Description The issue allows remote authenticated users to bypass intended access restrictions by leveraging two or more group memberships, due to the failure of mod/forum/classes/post form.php to enforce the moodle/site:accessallgroups capability requirement before proceeding with a post to all groups.
Recommendations For Moodle versions 2.3.11 and earlier, update to version 2.4.11 or later. For Moodle versions 2.4.x before 2.4.11, update to version 2.4.11 or later. For Moodle versions 2.5.x before 2.5.7, update to version 2.5.7 or later. For Moodle versions 2.6.x before 2.6.4, update to version 2.6.4 or later. For Moodle versions 2.7.x before 2.7.1, update to version 2.7.1 or later.

Fix

Found an issue in the description? Have something to add? Feel free to write us 👾
dbugs@ptsecurity.com

Weakness Enumeration

CWE-264

Related Identifiers

CVE-2014-3553
GHSA-MG69-5Q59-8JCG
MGASA-2014-0308

Affected Products

Moodle