Description

mod/data/edit.php in Moodle through 2.4.11, 2.5.x before 2.5.9, 2.6.x before 2.6.6, and 2.7.x before 2.7.3 sets a certain group ID to zero upon a database-entry change, which allows remote authenticated users to obtain sensitive information by accessing the database after an edit by a teacher.

Remediation

References

CVE-2014-7833

Related Vulnerabilities

Plone CMS Improper Neutralization of Input During Web Page Generation ('Cross-site Scripting') Vulnerability (CVE-2011-1949)

WordPress Plugin Gravity Forms Arbitrary File Upload (1.8.19)

WordPress Plugin mb.miniAudioPlayer-an HTML5 audio player for your mp3 files Multiple Cross-Site Scripting Vulnerabilities (1.3.8)

WordPress Plugin Software License Manager Cross-Site Scripting (4.4.7)

WordPress Plugin Site Reviews Cross-Site Scripting (5.13.0)

Severity

Medium

Classification

CVE-2014-7833 CWE-200

Tags

Missing Update Known Vulnerabilities