CVE-2017-7491: CSRF
Published May 15, 2017
·Updated
In Moodle 2.x and 3.x, a CSRF attack is possible that allows attackers to change the "number of courses displayed in the course overview block" configuration setting.
Affected Software
57 affected componentsFixes available
composer/moodle/moodle>=2.7<2.7.20
2.7.20
composer/moodle/moodle>=3.0<3.0.10
3.0.10
composer/moodle/moodle>=3.1<3.1.6
3.1.6
composer/moodle/moodle>=3.2<3.2.3
3.2.3
Moodle moodle=2.7.0
Moodle moodle=2.7.0-beta
Moodle moodle=2.7.0-rc1
Moodle moodle=2.7.0-rc2
Moodle moodle=2.7.1
Moodle moodle=2.7.2
Moodle moodle=2.7.3
Moodle moodle=2.7.4
Moodle moodle=2.7.5
Moodle moodle=2.7.6
Moodle moodle=2.7.7
Moodle moodle=2.7.8
Moodle moodle=2.7.9
Moodle moodle=2.7.10
Moodle moodle=2.7.11
Moodle moodle=2.7.12
Moodle moodle=2.7.13
Moodle moodle=2.7.14
Moodle moodle=2.7.15
Moodle moodle=2.7.16
Moodle moodle=2.7.17
Moodle moodle=2.7.18
Moodle moodle=3.0.0
Moodle moodle=3.0.0-beta
Moodle moodle=3.0.0-rc1
Moodle moodle=3.0.0-rc2
Moodle moodle=3.0.0-rc3
Moodle moodle=3.0.0-rc4
Moodle moodle=3.0.1
Moodle moodle=3.0.2
Moodle moodle=3.0.3
Moodle moodle=3.0.4
Moodle moodle=3.0.5
Moodle moodle=3.0.6
Moodle moodle=3.0.7
Moodle moodle=3.0.8
Moodle moodle=3.1.0
Moodle moodle=3.1.0-beta
Moodle moodle=3.1.0-rc1
Moodle moodle=3.1.0-rc2
Moodle moodle=3.1.1
Moodle moodle=3.1.2
Moodle moodle=3.1.3
Moodle moodle=3.1.4
Moodle moodle=3.2.0
Moodle moodle=3.2.0-beta
Moodle moodle=3.2.0-rc1
Moodle moodle=3.2.0-rc2
Moodle moodle=3.2.0-rc3
Moodle moodle=3.2.0-rc4
Moodle moodle=3.2.0-rc5
Moodle moodle=3.2.1
Moodle moodle=3.2.2
Remediation
Patch Available
Event History
May 15, 2017
CVE Published
via MITRE·02:00 PM
Data Sourced
via MITRE·02:00 PM
DescriptionWeakness
May 17, 2022
Advisory Published
via GitHub·02:44 AM
Frequently Asked Questions
1
What is the severity of CVE-2017-7491?
CVE-2017-7491 is classified as a medium severity vulnerability.
2
How do I fix CVE-2017-7491?
To fix CVE-2017-7491, upgrade Moodle to versions 2.7.20, 3.0.10, 3.1.6, or 3.2.3 or later.
3
What systems are affected by CVE-2017-7491?
CVE-2017-7491 affects Moodle versions 2.7.x and 3.0.x to 3.2.x.
4
What type of vulnerability is CVE-2017-7491?
CVE-2017-7491 is a Cross-Site Request Forgery (CSRF) vulnerability.
5
Can CVE-2017-7491 lead to unauthorized access?
Yes, CVE-2017-7491 can allow attackers to change settings without authorization.