CVE-2014-7833: Infoleak
Published Nov 24, 2014
·Updated
mod/data/edit.php in Moodle through 2.4.11, 2.5.x before 2.5.9, 2.6.x before 2.6.6, and 2.7.x before 2.7.3 sets a certain group ID to zero upon a database-entry change, which allows remote authenticated users to obtain sensitive information by accessing the database after an edit by a teacher.
Affected Software
22 affected componentsFixes available
composer/moodle/moodle>=2.7.0<2.7.3
2.7.3
composer/moodle/moodle>=2.6.0<2.6.6
2.6.6
composer/moodle/moodle<2.5.9
2.5.9
Moodle moodle<=2.4.11
Moodle moodle=2.5.0
Moodle moodle=2.5.1
Moodle moodle=2.5.2
Moodle moodle=2.5.3
Moodle moodle=2.5.4
Moodle moodle=2.5.5
Moodle moodle=2.5.6
Moodle moodle=2.5.7
Moodle moodle=2.5.8
Moodle moodle=2.6.0
Moodle moodle=2.6.1
Moodle moodle=2.6.2
Moodle moodle=2.6.3
Moodle moodle=2.6.4
Moodle moodle=2.6.5
Moodle moodle=2.7.0
Moodle moodle=2.7.1
Moodle moodle=2.7.2
Event History
Nov 24, 2014
CVE Published
via MITRE·11:00 AM
Data Sourced
via MITRE·11:00 AM
Description
May 13, 2022
Advisory Published
via GitHub·01:12 AM
Frequently Asked Questions
1
What is the severity of CVE-2014-7833?
CVE-2014-7833 is rated as a medium severity vulnerability.
2
How do I fix CVE-2014-7833?
To fix CVE-2014-7833, upgrade Moodle to version 2.5.9, 2.6.6, or 2.7.3 or higher.
3
What versions of Moodle are affected by CVE-2014-7833?
Versions of Moodle from 2.4.11 up to 2.7.2 are affected by CVE-2014-7833.
4
What kind of vulnerability is CVE-2014-7833?
CVE-2014-7833 is a sensitive information disclosure vulnerability.
5
Who can exploit CVE-2014-7833?
CVE-2014-7833 can be exploited by remote authenticated users with access to the affected Moodle instances.