Описание
mod/forum/post.php in Moodle 2.9.x before 2.9.1 does not consider the mod/forum:canposttomygroups capability before authorizing "Post a copy to all groups" actions, which allows remote authenticated users to bypass intended access restrictions by leveraging per-group authorization.
| Релиз | Статус | Примечание |
|---|---|---|
| devel | not-affected | 2.9 only |
| esm-infra-legacy/trusty | DNE | trusty/esm was DNE [trusty was not-affected [2.9 only]] |
| precise | not-affected | 2.9 only |
| trusty | not-affected | 2.9 only |
| trusty/esm | DNE | trusty was not-affected [2.9 only] |
| upstream | released | 2.9.1 |
| utopic | not-affected | 2.9 only |
| vivid | not-affected | 2.9 only |
Показывать по
EPSS
4 Medium
CVSS2
4.3 Medium
CVSS3
Связанные уязвимости
mod/forum/post.php in Moodle 2.9.x before 2.9.1 does not consider the mod/forum:canposttomygroups capability before authorizing "Post a copy to all groups" actions, which allows remote authenticated users to bypass intended access restrictions by leveraging per-group authorization.
mod/forum/post.php in Moodle 2.9.x before 2.9.1 does not consider the ...
mod/forum/post.php in Moodle 2.9.x before 2.9.1 does not consider the mod/forum:canposttomygroups capability before authorizing "Post a copy to all groups" actions, which allows remote authenticated users to bypass intended access restrictions by leveraging per-group authorization.
Уязвимость системы управления обучением Мoodle, позволяющая нарушителю обойти существующие ограничения доступа
EPSS
4 Medium
CVSS2
4.3 Medium
CVSS3