Description

Multiple cross-site request forgery (CSRF) vulnerabilities in the LTI module in Moodle through 2.4.11, 2.5.x before 2.5.9, 2.6.x before 2.6.6, and 2.7.x before 2.7.3 allow remote attackers to hijack the authentication of arbitrary users for a (1) mod/lti/request_tool.php or (2) mod/lti/instructor_edit_tool_type.php request.

Remediation

References

CVE-2014-7836

Related Vulnerabilities

Joomla Improper Neutralization of Input During Web Page Generation ('Cross-site Scripting') Vulnerability (CVE-2012-5455)

MyBB Improper Neutralization of Special Elements used in an SQL Command ('SQL Injection') Vulnerability (CVE-2008-0383)

WordPress Plugin Fitness Trainer-Training Membership Cross-Site Scripting (1.0.8)

MediaWiki Other Vulnerability (CVE-2013-2114)

WordPress Plugin Age Gate Cross-Site Scripting (2.16.3)

Severity

Medium

Classification

CVE-2014-7836 CWE-352

Tags

Missing Update Known Vulnerabilities