CVE-2014-9060: Input Validation
The LTI module in Moodle through 2.4.11, 2.5.x before 2.5.9, 2.6.x before 2.6.6, and 2.7.x before 2.7.3 does not properly restrict the parameters used in a return URL, which allows remote attackers to trigger the generation of arbitrary messages via a modified URL, related to mod/lti/locallib.php and mod/lti/return.php.
Affected Software
Event History
Frequently Asked Questions
What is the severity of CVE-2014-9060?
CVE-2014-9060 is classified as a medium severity vulnerability due to its potential for exploitation through modified URL parameters.
How do I fix CVE-2014-9060?
To resolve CVE-2014-9060, update Moodle to version 2.5.9, 2.6.6, or 2.7.3 or later.
What versions are affected by CVE-2014-9060?
CVE-2014-9060 affects Moodle versions up to 2.4.11, and all 2.5.x versions before 2.5.9, 2.6.x before 2.6.6, and 2.7.x before 2.7.3.
What components of Moodle does CVE-2014-9060 impact?
CVE-2014-9060 specifically impacts the LTI module in Moodle, particularly in mod/lti/locallib.php.
What are the potential risks of CVE-2014-9060?
The risks of CVE-2014-9060 include unauthorized message generation which could lead to phishing or other social engineering attacks.