CVE-2017-7490: Moodle Unauthorized searching of arbitrary blogs by typing full url
In Moodle 2.x and 3.x, searching of arbitrary blogs is possible because a capability check is missing.
Other sources
Moodle Unauthorized searching of arbitrary blogs by typing full url
— Packagist
Affected Software
Remediation
Recommended actions to resolve this vulnerability, in priority order.
- Upgrade
Upgrade
composer/moodle/moodleto a version that resolves this vulnerability.Fixed in 2.7.20 - Upgrade
Upgrade
composer/moodle/moodleto a version that resolves this vulnerability.Fixed in 3.0.10 - Upgrade
Upgrade
composer/moodle/moodleto a version that resolves this vulnerability.Fixed in 3.1.6 - Upgrade
Upgrade
composer/moodle/moodleto a version that resolves this vulnerability.Fixed in 3.2.3
Event History
Frequently Asked Questions
What is the severity of CVE-2017-7490?
CVE-2017-7490 has been classified with a medium severity level due to the potential for unauthorized access to arbitrary blogs.
How do I fix CVE-2017-7490?
To remediate CVE-2017-7490, update your Moodle instance to version 2.7.20 or later, or versions 3.0.10, 3.1.6, or 3.2.3.
Which versions of Moodle are affected by CVE-2017-7490?
CVE-2017-7490 affects Moodle versions 2.x and 3.x prior to the respective patched versions.
What type of vulnerability is CVE-2017-7490?
CVE-2017-7490 is categorized as a privilege escalation vulnerability because it allows unauthorized users to access arbitrary blogs.
Is there a workaround for CVE-2017-7490?
There is no official workaround; upgrading to a patched version is the recommended approach to mitigate CVE-2017-7490.