CVE-2014-0217: Infoleak
enrol/index.php in Moodle 2.6.x before 2.6.3 does not check for the moodle/course:viewhiddencourses capability before listing hidden courses, which allows remote attackers to obtain sensitive name and summary information about these courses by leveraging the guest role and visiting a crafted URL.
Affected Software
Event History
Frequently Asked Questions
What is the severity of CVE-2014-0217?
CVE-2014-0217 has a medium severity rating due to the potential exposure of sensitive information regarding hidden courses.
How do I fix CVE-2014-0217?
To fix CVE-2014-0217, upgrade your Moodle instance to version 2.6.3 or later.
What versions are affected by CVE-2014-0217?
CVE-2014-0217 affects Moodle versions 2.6.0, 2.6.1, and 2.6.2.
Can CVE-2014-0217 be exploited remotely?
Yes, CVE-2014-0217 can be exploited remotely by leveraging the guest role to access hidden course information.
What is the main issue with CVE-2014-0217?
The main issue with CVE-2014-0217 is the lack of capability checks for the moodle/course:viewhiddencourses permission when listing hidden courses.