CVE-2014-3553: Medium severity moodle vulnerability
mod/forum/classes/postform.php in Moodle through 2.3.11, 2.4.x before 2.4.11, 2.5.x before 2.5.7, 2.6.x before 2.6.4, and 2.7.x before 2.7.1 does not enforce the moodle/site:accessallgroups capability requirement before proceeding with a post to all groups, which allows remote authenticated users to bypass intended access restrictions by leveraging two or more group memberships.
Affected Software
Remediation
Event History
Frequently Asked Questions
What is the severity of CVE-2014-3553?
CVE-2014-3553 has been classified as a moderate severity vulnerability due to its potential for unauthorized access to group posts.
How do I fix CVE-2014-3553?
To fix CVE-2014-3553, upgrade your Moodle installation to version 2.5.7, 2.6.4, or 2.7.1 or later.
What versions of Moodle are affected by CVE-2014-3553?
CVE-2014-3553 affects Moodle versions up to 2.3.11, 2.4.x before 2.4.11, 2.5.x before 2.5.7, 2.6.x before 2.6.4, and 2.7.x before 2.7.1.
Can remote users exploit CVE-2014-3553?
Yes, remote authenticated users can exploit CVE-2014-3553 due to a lack of capability enforcement in the posting process.
What capability requirement is not enforced in CVE-2014-3553?
CVE-2014-3553 does not enforce the moodle/site:accessallgroups capability requirement for posting in all groups.