EUVD-2014-0113

Malware in sbrugna...

Unenforced Capability

Moodle has unenforced capabilities. The moodle/site:accessallgroups capability isn't enforced for outside-group users in the SEPARATEGROUPS configuration. Leveraging this flaw, authenticated attackers can perform login as actions through a direct request...

CVE-2014-0009

course/loginas.php in Moodle through 2.2.11, 2.3.x before 2.3.11, 2.4.x before 2.4.8, 2.5.x before 2.5.4, and 2.6.x before 2.6.1 does not enforce the moodle/site:accessallgroups capability requirement for outside-group users in a SEPARATEGROUPS configuration, which allows remote authenticated use...

CVE-2014-0009

CVE-2014-0009 affects Moodle in SEPARATEGROUPS mode where outside-group users can perform a problematic LOGIN AS action due to not enforcing the moodle/site:accessallgroups capability. Versions affected: Moodle 2.2.11; 2.3.x before 2.3.11; 2.4.x before 2.4.8; 2.5.x before 2.5.4; 2.6.x before 2.6....

CVE-2014-0009: Undefined Security Weakness

course/loginas.php in Moodle through 2.2.11, 2.3.x before 2.3.11, 2.4.x before 2.4.8, 2.5.x before 2.5.4, and 2.6.x before 2.6.1 does not enforce the moodle/site:accessallgroups capability requirement for outside-group users in a SEPARATEGROUPS configuration, which allows remote authenticated use...

PT-2014-3431

Name of the Vulnerable Software and Affected Versions Moodle versions 2.2.11 and earlier, 2.3.x before 2.3.11, 2.4.x before 2.4.8, 2.5.x before 2.5.4, 2.6.x before 2.6.1 Description The issue allows remote authenticated users to perform certain actions via a direct request, due to the lack of...