CVE-2014-0009: Medium severity Moodle moodle vulnerability
course/loginas.php in Moodle through 2.2.11, 2.3.x before 2.3.11, 2.4.x before 2.4.8, 2.5.x before 2.5.4, and 2.6.x before 2.6.1 does not enforce the moodle/site:accessallgroups capability requirement for outside-group users in a SEPARATEGROUPS configuration, which allows remote authenticated users to perform "login as" actions via a direct request.
Affected Software
Remediation
Recommended actions to resolve this vulnerability, in priority order.
- Upgrade
Upgrade
moodle/course/loginas.phpto a version that resolves this vulnerability.Fixed in 2.3.11 - Upgrade
Upgrade
moodle/course/loginas.phpto a version that resolves this vulnerability.Fixed in 2.4.8 - Upgrade
Upgrade
moodle/course/loginas.phpto a version that resolves this vulnerability.Fixed in 2.5.4 - Upgrade
Upgrade
moodle/course/loginas.phpto a version that resolves this vulnerability.Fixed in 2.6.1 - Upgrade
Upgrade
moodle/course/loginas.phpto a version that resolves this vulnerability.Fixed in 2.2.11
Event History
Frequently Asked Questions
What is the severity of CVE-2014-0009?
CVE-2014-0009 is classified as a medium severity vulnerability, affecting multiple Moodle versions.
How do I fix CVE-2014-0009?
To remediate CVE-2014-0009, upgrade your Moodle installation to a version that is above 2.6.1, 2.5.4, 2.4.8, 2.3.11, or 2.2.11.
Which Moodle versions are affected by CVE-2014-0009?
CVE-2014-0009 affects Moodle versions from 2.0.0 to 2.6.0, including all versions of 2.2.x, 2.3.x, 2.4.x, and 2.5.x prior to their respective updates.
What type of attack vector is associated with CVE-2014-0009?
CVE-2014-0009 can be exploited by authenticated users to access groups that they should not have permissions to view.
What is the impact of CVE-2014-0009 on Moodle security?
The impact of CVE-2014-0009 is that it allows unauthorized access to resources in a moodle site's groups configuration, potentially exposing sensitive information.