CVE-2017-7491: Moodle Cross-Site Request Forgery (CSRF)
In Moodle 2.x and 3.x, a CSRF attack is possible that allows attackers to change the "number of courses displayed in the course overview block" configuration setting.
Other sources
Moodle Cross-Site Request Forgery (CSRF)
— Packagist
Affected Software
Remediation
Recommended actions to resolve this vulnerability, in priority order.
- Upgrade
Upgrade
composer/moodle/moodleto a version that resolves this vulnerability.Fixed in 2.7.20 - Upgrade
Upgrade
composer/moodle/moodleto a version that resolves this vulnerability.Fixed in 3.0.10 - Upgrade
Upgrade
composer/moodle/moodleto a version that resolves this vulnerability.Fixed in 3.1.6 - Upgrade
Upgrade
composer/moodle/moodleto a version that resolves this vulnerability.Fixed in 3.2.3
Event History
Frequently Asked Questions
What is the severity of CVE-2017-7491?
CVE-2017-7491 is classified as a medium severity vulnerability.
How do I fix CVE-2017-7491?
To fix CVE-2017-7491, upgrade Moodle to versions 2.7.20, 3.0.10, 3.1.6, or 3.2.3 or later.
What systems are affected by CVE-2017-7491?
CVE-2017-7491 affects Moodle versions 2.7.x and 3.0.x to 3.2.x.
What type of vulnerability is CVE-2017-7491?
CVE-2017-7491 is a Cross-Site Request Forgery (CSRF) vulnerability.
Can CVE-2017-7491 lead to unauthorized access?
Yes, CVE-2017-7491 can allow attackers to change settings without authorization.