EUVD-2014-0113

Malware in sbrugna...

Unenforced Capability

Moodle has unenforced capabilities. The moodle/site:accessallgroups capability isn't enforced for outside-group users in the SEPARATEGROUPS configuration. Leveraging this flaw, authenticated attackers can perform login as actions through a direct request...

CVE-2014-0009

course/loginas.php in Moodle through 2.2.11, 2.3.x before 2.3.11, 2.4.x before 2.4.8, 2.5.x before 2.5.4, and 2.6.x before 2.6.1 does not enforce the moodle/site:accessallgroups capability requirement for outside-group users in a SEPARATEGROUPS configuration, which allows remote authenticated use...

CVE-2014-0009

CVE-2014-0009 affects Moodle in SEPARATEGROUPS mode where outside-group users can perform a problematic LOGIN AS action due to not enforcing the moodle/site:accessallgroups capability. Versions affected: Moodle 2.2.11; 2.3.x before 2.3.11; 2.4.x before 2.4.8; 2.5.x before 2.5.4; 2.6.x before 2.6....