CVE-2017-7489: Moodle External blog editing takeover
In Moodle 2.x and 3.x, remote authenticated users can take ownership of arbitrary blogs by editing an external blog link.
Affected Software
Remediation
Recommended actions to resolve this vulnerability, in priority order.
- Upgrade
Upgrade
composer/moodle/moodleto a version that resolves this vulnerability.Fixed in 2.7.20 - Upgrade
Upgrade
composer/moodle/moodleto a version that resolves this vulnerability.Fixed in 3.0.10 - Upgrade
Upgrade
composer/moodle/moodleto a version that resolves this vulnerability.Fixed in 3.1.6 - Upgrade
Upgrade
composer/moodle/moodleto a version that resolves this vulnerability.Fixed in 3.2.3
Event History
Frequently Asked Questions
What is the severity of CVE-2017-7489?
CVE-2017-7489 is rated as a medium severity vulnerability due to its potential for unauthorized access and modification.
How do I fix CVE-2017-7489?
To fix CVE-2017-7489, update Moodle to version 2.7.20 or later, 3.0.10 or later, 3.1.6 or later, or 3.2.3 or later.
Who is affected by CVE-2017-7489?
CVE-2017-7489 affects Moodle versions 2.7.x and 3.0.x to 3.2.x.
What type of vulnerability is CVE-2017-7489?
CVE-2017-7489 is a security vulnerability that allows remote authenticated users to take ownership of arbitrary blogs by editing external blog links.
Is there a patch available for CVE-2017-7489?
Yes, patches are included in the updated versions of Moodle that address CVE-2017-7489.