Description

lib/classes/grades_external.php in Moodle 2.7.x before 2.7.3 does not consider the moodle/grade:viewhidden capability before displaying hidden grades, which allows remote authenticated users to obtain sensitive information by leveraging the student role to access the get_grades web service.

Remediation

References

CVE-2014-7831

Related Vulnerabilities

Magento Unrestricted Upload of File with Dangerous Type Vulnerability (CVE-2021-21014)

Ruby on Rails Improper Neutralization of Special Elements used in an SQL Command ('SQL Injection') Vulnerability (CVE-2012-2695)

Internet Information Services Other Vulnerability (CVE-2002-0224)

MySQL CVE-2022-21600 Vulnerability (CVE-2022-21600)

WordPress Plugin SEO SearchTerms Tagging 2 Multiple Vulnerabilities (1.535)

Severity

Medium

Classification

CVE-2014-7831 CWE-200

Tags

Missing Update Known Vulnerabilities