Description

mod/forum/externallib.php in Moodle 2.6.x before 2.6.6 and 2.7.x before 2.7.3 does not verify group permissions, which allows remote authenticated users to access a forum via the forum_get_discussions web service.

Remediation

References

CVE-2014-7834

Related Vulnerabilities

WordPress Plugin Affiliates Multiple Cross-Site Scripting Vulnerabilities (2.13.1)

WordPress Plugin Portfolio Gallery-Photo Gallery Cross-Site Scripting (1.5.7)

Liferay Portal Unrestricted Upload of File with Dangerous Type Vulnerability (CVE-2020-15839)

Spring Cloud Gateway Incorrect Authorization Vulnerability (CVE-2021-22051)

WordPress Plugin S3 Video Cross-Site Scripting (0.97)

Severity

Medium

Classification

CVE-2014-7834 CWE-264

Tags

Missing Update Known Vulnerabilities