Description

lib/db/access.php in Moodle 2.0.x before 2.0.4 and 2.1.x before 2.1.1 assigns incorrect capabilities to the course-creator role, which allows remote authenticated users to modify course filters by leveraging this role.

Remediation

References

CVE-2011-4296

Related Vulnerabilities

Oracle Database Server CVE-2006-5334 Vulnerability (CVE-2006-5334)

Dotclear Improper Neutralization of Input During Web Page Generation ('Cross-site Scripting') Vulnerability (CVE-2018-5690)

WordPress 4.6.x Multiple Vulnerabilities (4.6 - 4.6.27)

Python Improper Limitation of a Pathname to a Restricted Directory ('Path Traversal') Vulnerability (CVE-2019-9948)

Apache Tomcat Exposure of Sensitive Information to an Unauthorized Actor Vulnerability (CVE-2016-8747)

Severity

Medium

Classification

CVE-2011-4296 CWE-264

Tags

Missing Update Known Vulnerabilities