CVE-2014-7833: Moodle allows attackers to obtain sensitive information
mod/data/edit.php in Moodle through 2.4.11, 2.5.x before 2.5.9, 2.6.x before 2.6.6, and 2.7.x before 2.7.3 sets a certain group ID to zero upon a database-entry change, which allows remote authenticated users to obtain sensitive information by accessing the database after an edit by a teacher.
Other sources
Moodle allows attackers to obtain sensitive information
— Packagist
Affected Software
Remediation
Recommended actions to resolve this vulnerability, in priority order.
- Upgrade
Upgrade
composer/moodle/moodleto a version that resolves this vulnerability.Fixed in 2.7.3 - Upgrade
Upgrade
composer/moodle/moodleto a version that resolves this vulnerability.Fixed in 2.6.6 - Upgrade
Upgrade
composer/moodle/moodleto a version that resolves this vulnerability.Fixed in 2.5.9
Event History
Frequently Asked Questions
What is the severity of CVE-2014-7833?
CVE-2014-7833 is rated as a medium severity vulnerability.
How do I fix CVE-2014-7833?
To fix CVE-2014-7833, upgrade Moodle to version 2.5.9, 2.6.6, or 2.7.3 or higher.
What versions of Moodle are affected by CVE-2014-7833?
Versions of Moodle from 2.4.11 up to 2.7.2 are affected by CVE-2014-7833.
What kind of vulnerability is CVE-2014-7833?
CVE-2014-7833 is a sensitive information disclosure vulnerability.
Who can exploit CVE-2014-7833?
CVE-2014-7833 can be exploited by remote authenticated users with access to the affected Moodle instances.