CVE-2014-7838: Moodle has multiple cross-site request forgery (CSRF) vulnerabilities in the Forum module
Moodle has multiple cross-site request forgery (CSRF) vulnerabilities in the Forum module
Other sources
Multiple cross-site request forgery (CSRF) vulnerabilities in the Forum module in Moodle through 2.4.11, 2.5.x before 2.5.9, 2.6.x before 2.6.6, and 2.7.x before 2.7.3 allow remote attackers to hijack the authentication of arbitrary users for requests that set a tracking preference within (1) mod/forum/deprecatedlib.php, (2) mod/forum/forum.js, (3) mod/forum/index.php, or (4) mod/forum/lib.php.
— GitHub
Affected Software
Remediation
Recommended actions to resolve this vulnerability, in priority order.
- Upgrade
Upgrade
composer/moodle/moodleto a version that resolves this vulnerability.Fixed in 2.7.3 - Upgrade
Upgrade
composer/moodle/moodleto a version that resolves this vulnerability.Fixed in 2.6.6 - Upgrade
Upgrade
composer/moodle/moodleto a version that resolves this vulnerability.Fixed in 2.5.9
Event History
Frequently Asked Questions
What is the severity of CVE-2014-7838?
CVE-2014-7838 has a medium severity rating due to its potential impact on user authentication and privacy.
How do I fix CVE-2014-7838?
To fix CVE-2014-7838, upgrade to Moodle version 2.5.9, 2.6.6, or 2.7.3 or later.
What type of vulnerability is CVE-2014-7838?
CVE-2014-7838 is classified as a cross-site request forgery (CSRF) vulnerability.
Who is affected by CVE-2014-7838?
CVE-2014-7838 affects users of Moodle versions 2.4.11 and earlier, as well as 2.5.x, 2.6.x, and 2.7.x prior to their respective fixed versions.
What can an attacker do exploiting CVE-2014-7838?
An attacker exploiting CVE-2014-7838 could hijack the authentication of arbitrary users to set tracking preferences.