Description

badges/mybadges.php in Moodle 2.5.x before 2.5.5 and 2.6.x before 2.6.2 does not properly track the user to whom a badge was issued, which allows remote authenticated users to modify the visibility of an arbitrary badge via unspecified vectors.

Remediation

References

CVE-2014-0129

Related Vulnerabilities

Python Buffer Copy without Checking Size of Input ('Classic Buffer Overflow') Vulnerability (CVE-2008-3142)

WordPress Other Vulnerability (CVE-2007-2627)

Piwigo Improper Neutralization of Special Elements used in an SQL Command ('SQL Injection') Vulnerability (CVE-2023-37270)

Moodle URL Redirection to Untrusted Site ('Open Redirect') Vulnerability (CVE-2019-10133)

MediaWiki Release of Invalid Pointer or Reference Vulnerability (CVE-2022-28203)

Severity

Medium

Classification

CVE-2014-0129 CWE-264

Tags

Missing Update Known Vulnerabilities