CVE-2014-2572: Medium severity Moodle moodle vulnerability
Published Mar 22, 2014
·Updated
mod/assign/externallib.php in Moodle 2.6.x before 2.6.2 does not properly handle assignment web-service parameters, which might allow remote authenticated users to modify grade metadata via unspecified vectors.
Affected Software
3 affected componentsFixes available
composer/moodle/moodle>=2.6.0<2.6.2
2.6.2
Moodle moodle=2.6.0
Moodle moodle=2.6.1
Remediation
Recommended actions to resolve this vulnerability, in priority order.
- Upgrade
Upgrade
composer/moodle/moodleto a version that resolves this vulnerability.Fixed in 2.6.2
Event History
Mar 22, 2014
CVE Published
via MITRE·01:00 AM
Data Sourced
via MITRE·01:00 AM
Description
Mar 24, 2014
Data Sourced
via NVD·02:20 PM
DescriptionSeverityWeaknessAffected Software
May 13, 2022
Advisory Published
via GitHub·01:12 AM
Frequently Asked Questions
1
What is the severity of CVE-2014-2572?
CVE-2014-2572 has been classified as a medium severity vulnerability.
2
How do I fix CVE-2014-2572?
To fix CVE-2014-2572, upgrade your Moodle installation to version 2.6.2 or later.
3
Who is affected by CVE-2014-2572?
CVE-2014-2572 affects authenticated users on Moodle versions 2.6.0 and 2.6.1.
4
What types of attacks does CVE-2014-2572 allow?
CVE-2014-2572 may allow remote authenticated users to modify grade metadata.
5
Which Moodle versions are vulnerable to CVE-2014-2572?
Moodle versions 2.6.0 and 2.6.1 are vulnerable to CVE-2014-2572.