GitHub Advisoryadvisory · Packagist

GHSA-mphj-h2fc-62x3 Moodle allows attackers to bypass the mod/lti:view capability requirement

MEDIUM Published 2022-05-13 Modified 2024-01-24 Official page ↗
Aliases
CVE-2014-7832
Ecosystem
Packagist
Packages
moodle/moodle
Severity
Moderate
Reviewed
2024-01-24

Affected packages

• Packagist moodle/moodle: < 2.5.9 → fixed in 2.5.9 • Packagist moodle/moodle: >= 2.6.0, < 2.6.6 → fixed in 2.6.6 • Packagist moodle/moodle: >= 2.7.0, < 2.7.3 → fixed in 2.7.3

Description

mod/lti/launch.php in the LTI module in Moodle through 2.4.11, 2.5.x before 2.5.9, 2.6.x before 2.6.6, and 2.7.x before 2.7.3 performs access control at the course level rather than at the activity level, which allows remote authenticated users to bypass the mod/lti:view capability requirement by viewing an activity instance.

Related

Alias · CVE (1)

  • CVE-2014-7832 mod/lti/launch.php in the LTI module in Moodle through 2.4.11, 2.5.x before 2.5.9, 2.6.x before 2.6.6, and 2.7.x before 2.7.3 performs… vulnerability

References