CVE-2014-7833CVE-2014-7833

Affected configuration(s):

cpe:/a:moodle:moodle:2.4.11
cpe:/a:moodle:moodle:2.5
cpe:/a:moodle:moodle:2.5.1
cpe:/a:moodle:moodle:2.5.2
cpe:/a:moodle:moodle:2.5.3
cpe:/a:moodle:moodle:2.5.4
cpe:/a:moodle:moodle:2.5.5
cpe:/a:moodle:moodle:2.5.6
cpe:/a:moodle:moodle:2.5.7
cpe:/a:moodle:moodle:2.5.8
cpe:/a:moodle:moodle:2.6
cpe:/a:moodle:moodle:2.6.1
cpe:/a:moodle:moodle:2.6.2
cpe:/a:moodle:moodle:2.6.3
cpe:/a:moodle:moodle:2.6.4
cpe:/a:moodle:moodle:2.6.5
cpe:/a:moodle:moodle:2.7
cpe:/a:moodle:moodle:2.7.1
cpe:/a:moodle:moodle:2.7.2

Date published: 2014-11-24T06:59:03.757-05:00

Date last modified: 2015-10-05T22:24:22.353-04:00

CVSS Score: 4.0

Principal attack vector: NETWORK

Complexity:  LOW

Reference URL: http://git.moodle.org/gw?p=moodle.git&a=search&h=HEAD&st=commit&s=MDL-47697

Summary: mod/data/edit.php in Moodle through 2.4.11, 2.5.x before 2.5.9, 2.6.x before 2.6.6, and 2.7.x before 2.7.3 sets a certain group ID to zero upon a database-entry change, which allows remote authenticated users to obtain sensitive information by accessing the database after an edit by a teacher.

CategoriesUncategorised

Leave a Reply

Your email address will not be published. Required fields are marked *

This site uses Akismet to reduce spam. Learn how your comment data is processed.