GitHub Advisoryadvisory · Packagist

GHSA-r867-v437-4rrm Moodle Cross-site request forgery (CSRF) vulnerability

HIGH Published 2022-05-13 Modified 2024-01-26 Official page ↗
Aliases
CVE-2016-3734
Ecosystem
Packagist
Packages
moodle/moodle
Severity
High
CVSS vector
CVSS:3.0/AV:N/AC:L/PR:N/UI:R/S:U/C:H/I:H/A:H
Weaknesses
CWE-352
Reviewed
2024-01-26

Affected packages

• Packagist moodle/moodle: < 2.7.14 → fixed in 2.7.14 • Packagist moodle/moodle: >= 2.8, < 2.8.12 → fixed in 2.8.12 • Packagist moodle/moodle: >= 2.9, < 2.9.6 → fixed in 2.9.6 • Packagist moodle/moodle: >= 3.0, < 3.0.4 → fixed in 3.0.4

Description

Cross-site request forgery (CSRF) vulnerability in markposts.php in Moodle 3.0 through 3.0.3, 2.9 through 2.9.5, 2.8 through 2.8.11, 2.7 through 2.7.13 and earlier allows remote attackers to hijack the authentication of users for requests that marks forum posts as read.

Related

Alias · CVE (1)

  • CVE-2016-3734 Cross-site request forgery (CSRF) vulnerability in markposts.php in Moodle 3.0 through 3.0.3, 2.9 through 2.9.5, 2.8 through 2.8.11, 2.7… vulnerability

Weakness · CWE (1)

  • CWE-352 Cross-Site Request Forgery weakness

References