Description

mod/forum/unsubscribeall.php in Moodle 2.1.x before 2.1.7 and 2.2.x before 2.2.4 does not consider whether a forum is optional, which allows remote authenticated users to bypass forum-subscription requirements by leveraging the student role and unsubscribing from all forums.

Remediation

References

CVE-2012-3392

Related Vulnerabilities

Oracle Database Server CVE-2018-2680 Vulnerability (CVE-2018-2680)

WordPress 4.1.x Multiple Vulnerabilities (4.1 - 4.1.11)

Piwigo Improper Neutralization of Special Elements used in an SQL Command ('SQL Injection') Vulnerability (CVE-2020-19215)

MySQL CVE-2016-0665 Vulnerability (CVE-2016-0665)

WordPress Plugin WooCommerce Enhanced Ecommerce Analytics Integration with Conversion Tracking Multiple Vulnerabilities (1.8)

Severity

Medium

Classification

CVE-2012-3392

Tags

Missing Update Known Vulnerabilities