CVE-2014-7846: Medium severity moodle vulnerability
tag/tagautocomplete.php in Moodle through 2.4.11, 2.5.x before 2.5.9, 2.6.x before 2.6.6, and 2.7.x before 2.7.3 does not consider the moodle/tag:edit capability before adding a tag, which allows remote authenticated users to bypass intended access restrictions via an AJAX request.
Affected Software
Remediation
Event History
Frequently Asked Questions
What is the severity of CVE-2014-7846?
CVE-2014-7846 has a medium severity due to its potential for unauthorized access in Moodle installations.
How do I fix CVE-2014-7846?
To fix CVE-2014-7846, upgrade Moodle to version 2.5.9, 2.6.6, or 2.7.3 or later.
What versions of Moodle are affected by CVE-2014-7846?
CVE-2014-7846 affects Moodle versions 2.4.11, 2.5.0 through 2.5.8, 2.6.0 through 2.6.5, and 2.7.0 through 2.7.2.
Can CVE-2014-7846 be exploited by unauthenticated users?
No, CVE-2014-7846 requires remote authenticated users to exploit the vulnerability.
What is the impact of CVE-2014-7846?
The impact of CVE-2014-7846 allows authenticated users to add tags without proper permissions, potentially leading to content management issues.