Description

tag/tag_autocomplete.php in Moodle through 2.4.11, 2.5.x before 2.5.9, 2.6.x before 2.6.6, and 2.7.x before 2.7.3 does not consider the moodle/tag:edit capability before adding a tag, which allows remote authenticated users to bypass intended access restrictions via an AJAX request.

Remediation

References

CVE-2014-7846

Related Vulnerabilities

Joomla Improper Neutralization of Input During Web Page Generation ('Cross-site Scripting') Vulnerability (CVE-2009-1940)

Envoy Proxy Improper Check for Unusual or Exceptional Conditions Vulnerability (CVE-2021-32780)

Moodle Other Vulnerability (CVE-2019-10154)

PHP Out-of-bounds Read Vulnerability (CVE-2019-11042)

WordPress Plugin Ultimate Addons for Beaver Builder Cross-Site Scripting (1.24.3)

Severity

Medium

Classification

CVE-2014-7846 CWE-264

Tags

Missing Update Known Vulnerabilities