CVEdetails.com the ultimate security vulnerability data source
(e.g.: CVE-2009-1234 or 2010-1234 or 20101234)
Log In   Register
Vulnerability Feeds & WidgetsNew   www.itsecdb.com  

Moodle » Moodle » 2.7.14 : Security Vulnerabilities

Cpe Name:cpe:/a:moodle:moodle:2.7.14
Press ESC to close
# CVE ID CWE ID # of Exploits Vulnerability Type(s) Publish Date Update Date Score Gained Access Level Access Complexity Authentication Conf. Integ. Avail.
1 CVE-2019-10189 284 2019-07-31 2019-08-27
4.0
None Remote Low Single system None Partial None
A flaw was found in moodle before versions 3.7.1, 3.6.5, 3.5.7. Teachers in an assignment group could modify group overrides for other groups in the same assignment.
2 CVE-2019-10188 284 2019-07-31 2019-08-27
4.0
None Remote Low Single system None Partial None
A flaw was found in moodle before versions 3.7.1, 3.6.5, 3.5.7. Teachers in a quiz group could modify group overrides for other groups in the same quiz.
3 CVE-2019-10187 284 2019-07-31 2019-08-27
4.0
None Remote Low Single system None Partial None
A flaw was found in moodle before versions 3.7.1, 3.6.5, 3.5.7. Users with permission to delete entries from a glossary were able to delete entries from other glossaries they did not have direct access to.
4 CVE-2019-10186 352 CSRF 2019-07-31 2019-08-27
6.8
None Remote Medium Not required Partial Partial Partial
A flaw was found in moodle before versions 3.7.1, 3.6.5, 3.5.7. A sesskey (CSRF) token was not being utilised by the XML loading/unloading admin tool.
5 CVE-2019-10154 284 2019-06-26 2019-10-09
5.0
None Remote Low Not required Partial None None
A flaw was found in Moodle before versions 3.7, 3.6.4. A web service fetching messages was not restricted to the current user's conversations.
6 CVE-2019-3852 264 2019-03-26 2019-10-09
4.0
None Remote Low Single system None Partial None
A vulnerability was found in moodle before version 3.6.3. The get_with_capability_join and get_users_by_capability functions were not taking context freezing into account when checking user capabilities
7 CVE-2019-3850 601 2019-03-26 2019-10-09
5.8
None Remote Medium Not required Partial Partial None
A vulnerability was found in moodle before versions 3.6.3, 3.5.5, 3.4.8 and 3.1.17. Links within assignment submission comments would open directly (in the same window). Although links themselves may be valid, opening within the same window and without the no-referrer header policy made them more susceptible to exploits.
8 CVE-2019-3849 264 2019-03-26 2019-10-09
6.5
None Remote Low Single system Partial Partial Partial
A vulnerability was found in moodle before versions 3.6.3, 3.5.5 and 3.4.8. Users could assign themselves an escalated role within courses or content accessed via LTI, by modifying the request to the LTI publisher site.
9 CVE-2019-3848 200 +Info 2019-03-26 2019-10-09
4.0
None Remote Low Single system Partial None None
A vulnerability was found in moodle before versions 3.6.3, 3.5.5 and 3.4.8. Permissions were not correctly checked before loading event information into the calendar's edit event modal popup, so logged in non-guest users could view unauthorised calendar events. (Note: It was read-only access, users could not edit the events.)
10 CVE-2019-3847 20 2019-03-27 2019-04-04
6.5
None Remote Low Single system Partial Partial Partial
A vulnerability was found in moodle before versions 3.6.3, 3.5.5, 3.4.8 and 3.1.17. Users with the "login as other users" capability (such as administrators/managers) can access other users' Dashboards, but the JavaScript those other users may have added to their Dashboard was not being escaped when being viewed by the user logging in on their behalf.
11 CVE-2017-7491 352 CSRF 2017-05-15 2017-05-23
4.3
None Remote Medium Not required None Partial None
In Moodle 2.x and 3.x, a CSRF attack is possible that allows attackers to change the "number of courses displayed in the course overview block" configuration setting.
12 CVE-2017-7490 668 2017-05-15 2019-10-02
5.0
None Remote Low Not required Partial None None
In Moodle 2.x and 3.x, searching of arbitrary blogs is possible because a capability check is missing.
13 CVE-2017-7489 269 2017-05-15 2019-10-02
6.5
None Remote Low Single system Partial Partial Partial
In Moodle 2.x and 3.x, remote authenticated users can take ownership of arbitrary blogs by editing an external blog link.
14 CVE-2017-2641 89 Sql 2017-03-26 2017-08-15
7.5
None Remote Low Not required Partial Partial Partial
In Moodle 2.x and 3.x, SQL injection can occur via user preferences.
15 CVE-2016-5013 74 2017-01-20 2017-01-25
5.8
None Remote Medium Not required Partial Partial None
In Moodle 2.x and 3.x, text injection can occur in email headers, potentially leading to outbound spam.
Total number of vulnerabilities : 15   Page : 1 (This Page)
CVE is a registred trademark of the MITRE Corporation and the authoritative source of CVE content is MITRE's CVE web site. CWE is a registred trademark of the MITRE Corporation and the authoritative source of CWE content is MITRE's CWE web site. OVAL is a registered trademark of The MITRE Corporation and the authoritative source of OVAL content is MITRE's OVAL web site.
Use of this information constitutes acceptance for use in an AS IS condition. There are NO warranties, implied or otherwise, with regard to this information or its use. Any use of this information is at the user's risk. It is the responsibility of user to evaluate the accuracy, completeness or usefulness of any information, opinion, advice or other content. EACH USER WILL BE SOLELY RESPONSIBLE FOR ANY consequences of his or her direct or indirect use of this web site. ALL WARRANTIES OF ANY KIND ARE EXPRESSLY DISCLAIMED. This site will NOT BE LIABLE FOR ANY DIRECT, INDIRECT or any other kind of loss.