CVE-2017-7490: Medium severity Moodle moodle vulnerability
Published May 15, 2017
·Updated
In Moodle 2.x and 3.x, searching of arbitrary blogs is possible because a capability check is missing.
Affected Software
57 affected componentsFixes available
composer/moodle/moodle>=2.7<2.7.20
2.7.20
composer/moodle/moodle>=3.0<3.0.10
3.0.10
composer/moodle/moodle>=3.1<3.1.6
3.1.6
composer/moodle/moodle>=3.2<3.2.3
3.2.3
Moodle moodle=2.7.0
Moodle moodle=2.7.0-beta
Moodle moodle=2.7.0-rc1
Moodle moodle=2.7.0-rc2
Moodle moodle=2.7.1
Moodle moodle=2.7.2
Moodle moodle=2.7.3
Moodle moodle=2.7.4
Moodle moodle=2.7.5
Moodle moodle=2.7.6
Moodle moodle=2.7.7
Moodle moodle=2.7.8
Moodle moodle=2.7.9
Moodle moodle=2.7.10
Moodle moodle=2.7.11
Moodle moodle=2.7.12
Moodle moodle=2.7.13
Moodle moodle=2.7.14
Moodle moodle=2.7.15
Moodle moodle=2.7.16
Moodle moodle=2.7.17
Moodle moodle=2.7.18
Moodle moodle=3.0.0
Moodle moodle=3.0.0-beta
Moodle moodle=3.0.0-rc1
Moodle moodle=3.0.0-rc2
Moodle moodle=3.0.0-rc3
Moodle moodle=3.0.0-rc4
Moodle moodle=3.0.1
Moodle moodle=3.0.2
Moodle moodle=3.0.3
Moodle moodle=3.0.4
Moodle moodle=3.0.5
Moodle moodle=3.0.6
Moodle moodle=3.0.7
Moodle moodle=3.0.8
Moodle moodle=3.1.0
Moodle moodle=3.1.0-beta
Moodle moodle=3.1.0-rc1
Moodle moodle=3.1.0-rc2
Moodle moodle=3.1.1
Moodle moodle=3.1.2
Moodle moodle=3.1.3
Moodle moodle=3.1.4
Moodle moodle=3.2.0
Moodle moodle=3.2.0-beta
Moodle moodle=3.2.0-rc1
Moodle moodle=3.2.0-rc2
Moodle moodle=3.2.0-rc3
Moodle moodle=3.2.0-rc4
Moodle moodle=3.2.0-rc5
Moodle moodle=3.2.1
Moodle moodle=3.2.2
Remediation
Patch Available
Event History
May 15, 2017
CVE Published
via MITRE·02:00 PM
Data Sourced
via MITRE·02:00 PM
DescriptionWeakness
May 13, 2022
Advisory Published
via GitHub·01:47 AM
Frequently Asked Questions
1
What is the severity of CVE-2017-7490?
CVE-2017-7490 has been classified with a medium severity level due to the potential for unauthorized access to arbitrary blogs.
2
How do I fix CVE-2017-7490?
To remediate CVE-2017-7490, update your Moodle instance to version 2.7.20 or later, or versions 3.0.10, 3.1.6, or 3.2.3.
3
Which versions of Moodle are affected by CVE-2017-7490?
CVE-2017-7490 affects Moodle versions 2.x and 3.x prior to the respective patched versions.
4
What type of vulnerability is CVE-2017-7490?
CVE-2017-7490 is categorized as a privilege escalation vulnerability because it allows unauthorized users to access arbitrary blogs.
5
Is there a workaround for CVE-2017-7490?
There is no official workaround; upgrading to a patched version is the recommended approach to mitigate CVE-2017-7490.