CVE-2014-7838: CSRF
Multiple cross-site request forgery (CSRF) vulnerabilities in the Forum module in Moodle through 2.4.11, 2.5.x before 2.5.9, 2.6.x before 2.6.6, and 2.7.x before 2.7.3 allow remote attackers to hijack the authentication of arbitrary users for requests that set a tracking preference within (1) mod/forum/deprecatedlib.php, (2) mod/forum/forum.js, (3) mod/forum/index.php, or (4) mod/forum/lib.php.
Affected Software
Remediation
Event History
Frequently Asked Questions
What is the severity of CVE-2014-7838?
CVE-2014-7838 has a medium severity rating due to its potential impact on user authentication and privacy.
How do I fix CVE-2014-7838?
To fix CVE-2014-7838, upgrade to Moodle version 2.5.9, 2.6.6, or 2.7.3 or later.
What type of vulnerability is CVE-2014-7838?
CVE-2014-7838 is classified as a cross-site request forgery (CSRF) vulnerability.
Who is affected by CVE-2014-7838?
CVE-2014-7838 affects users of Moodle versions 2.4.11 and earlier, as well as 2.5.x, 2.6.x, and 2.7.x prior to their respective fixed versions.
What can an attacker do exploiting CVE-2014-7838?
An attacker exploiting CVE-2014-7838 could hijack the authentication of arbitrary users to set tracking preferences.