CVE-2014-3553: Moodle does not enforce the moodle/site:accessallgroups capability requirement
mod/forum/classes/postform.php in Moodle through 2.3.11, 2.4.x before 2.4.11, 2.5.x before 2.5.7, 2.6.x before 2.6.4, and 2.7.x before 2.7.1 does not enforce the moodle/site:accessallgroups capability requirement before proceeding with a post to all groups, which allows remote authenticated users to bypass intended access restrictions by leveraging two or more group memberships.
Other sources
Moodle does not enforce the moodle/site:accessallgroups capability requirement
— Packagist
Affected Software
Remediation
Recommended actions to resolve this vulnerability, in priority order.
- Upgrade
Upgrade
composer/moodle/moodleto a version that resolves this vulnerability.Fixed in 2.7.1 - Upgrade
Upgrade
composer/moodle/moodleto a version that resolves this vulnerability.Fixed in 2.6.4 - Upgrade
Upgrade
composer/moodle/moodleto a version that resolves this vulnerability.Fixed in 2.5.7 - Upgrade
Upgrade
Moodleto a version that resolves this vulnerability.Fixed in 2.4.11 - Upgrade
Upgrade
Moodleto a version that resolves this vulnerability.Fixed in 2.5.7 - Upgrade
Upgrade
Moodleto a version that resolves this vulnerability.Fixed in 2.6.4 - Upgrade
Upgrade
Moodleto a version that resolves this vulnerability.Fixed in 2.7.1
Event History
Frequently Asked Questions
What is the severity of CVE-2014-3553?
CVE-2014-3553 has been classified as a moderate severity vulnerability due to its potential for unauthorized access to group posts.
How do I fix CVE-2014-3553?
To fix CVE-2014-3553, upgrade your Moodle installation to version 2.5.7, 2.6.4, or 2.7.1 or later.
What versions of Moodle are affected by CVE-2014-3553?
CVE-2014-3553 affects Moodle versions up to 2.3.11, 2.4.x before 2.4.11, 2.5.x before 2.5.7, 2.6.x before 2.6.4, and 2.7.x before 2.7.1.
Can remote users exploit CVE-2014-3553?
Yes, remote authenticated users can exploit CVE-2014-3553 due to a lack of capability enforcement in the posting process.
What capability requirement is not enforced in CVE-2014-3553?
CVE-2014-3553 does not enforce the moodle/site:accessallgroups capability requirement for posting in all groups.