CVE-2014-9060: Moodle allows attackers to trigger the generation of arbitrary messages
Moodle allows attackers to trigger the generation of arbitrary messages
Other sources
The LTI module in Moodle through 2.4.11, 2.5.x before 2.5.9, 2.6.x before 2.6.6, and 2.7.x before 2.7.3 does not properly restrict the parameters used in a return URL, which allows remote attackers to trigger the generation of arbitrary messages via a modified URL, related to mod/lti/locallib.php and mod/lti/return.php.
— GitHub
Affected Software
Remediation
Recommended actions to resolve this vulnerability, in priority order.
- Upgrade
Upgrade
composer/moodle/moodleto a version that resolves this vulnerability.Fixed in 2.7.3 - Upgrade
Upgrade
composer/moodle/moodleto a version that resolves this vulnerability.Fixed in 2.6.6 - Upgrade
Upgrade
composer/moodle/moodleto a version that resolves this vulnerability.Fixed in 2.5.9 - Upgrade
Upgrade
Moodleto a version that resolves this vulnerability.Fixed in 2.5.9 - Upgrade
Upgrade
Moodleto a version that resolves this vulnerability.Fixed in 2.6.6 - Upgrade
Upgrade
Moodleto a version that resolves this vulnerability.Fixed in 2.7.3
Event History
Frequently Asked Questions
What is the severity of CVE-2014-9060?
CVE-2014-9060 is classified as a medium severity vulnerability due to its potential for exploitation through modified URL parameters.
How do I fix CVE-2014-9060?
To resolve CVE-2014-9060, update Moodle to version 2.5.9, 2.6.6, or 2.7.3 or later.
What versions are affected by CVE-2014-9060?
CVE-2014-9060 affects Moodle versions up to 2.4.11, and all 2.5.x versions before 2.5.9, 2.6.x before 2.6.6, and 2.7.x before 2.7.3.
What components of Moodle does CVE-2014-9060 impact?
CVE-2014-9060 specifically impacts the LTI module in Moodle, particularly in mod/lti/locallib.php.
What are the potential risks of CVE-2014-9060?
The risks of CVE-2014-9060 include unauthorized message generation which could lead to phishing or other social engineering attacks.