Description

The wiki subsystem in Moodle through 2.3.11, 2.4.x before 2.4.9, 2.5.x before 2.5.5, and 2.6.x before 2.6.2 does not properly restrict (1) view and (2) edit access, which allows remote authenticated users to perform wiki operations by leveraging the student role and using the Recent Activity block to reach the individual wiki of an arbitrary student.

Remediation

References

CVE-2014-0123

Related Vulnerabilities

Drupal CVE-2017-6919 Vulnerability (CVE-2017-6919)

PrestaShop Improper Neutralization of Input During Web Page Generation ('Cross-site Scripting') Vulnerability (CVE-2020-5278)

WordPress Plugin FancyFlickr Cross-Site Scripting (1.0)

MediaWiki Improper Neutralization of Input During Web Page Generation ('Cross-site Scripting') Vulnerability (CVE-2023-37251)

Atlassian Jira Exposure of Resource to Wrong Sphere Vulnerability (CVE-2021-39127)

Severity

Medium

Classification

CVE-2014-0123 CWE-264

Tags

Missing Update Known Vulnerabilities