GHSA-43r4-vm25-qm78
Suggest an improvement- Source
- https://github.com/advisories/GHSA-43r4-vm25-qm78
- Import Source
- https://github.com/github/advisory-database/blob/main/advisories/github-reviewed/2022/05/GHSA-43r4-vm25-qm78/GHSA-43r4-vm25-qm78.json
- JSON Data
- https://api.osv.dev/v1/vulns/GHSA-43r4-vm25-qm78
- Aliases
-
- CVE-2014-7838
- Published
- 2022-05-13T01:12:42Z
- Modified
- 2024-12-07T05:40:09.047094Z
- Summary
- Moodle has multiple cross-site request forgery (CSRF) vulnerabilities in the Forum module
- Details
-
Multiple cross-site request forgery (CSRF) vulnerabilities in the Forum module in Moodle through 2.4.11, 2.5.x before 2.5.9, 2.6.x before 2.6.6, and 2.7.x before 2.7.3 allow remote attackers to hijack the authentication of arbitrary users for requests that set a tracking preference within (1) mod/forum/deprecatedlib.php, (2) mod/forum/forum.js, (3) mod/forum/index.php, or (4) mod/forum/lib.php.
- Database specific
{ "nvd_published_at": "2014-11-24T11:59:00Z", "cwe_ids": [ "CWE-352" ], "severity": "MODERATE", "github_reviewed": true, "github_reviewed_at": "2024-01-24T21:41:50Z" }- References
-
- https://nvd.nist.gov/vuln/detail/CVE-2014-7838
- https://github.com/moodle/moodle/commit/545eb1bcfdbfc352bf6c31edf440485ba6d5af42
- https://github.com/moodle/moodle/commit/7a311adbba9471edb5a49e4c4b8c356c87f0e44b
- https://github.com/moodle/moodle/commit/bef4a5e01739f2b239c0910b9e1aa2841b979f7d
- https://github.com/moodle/moodle/commit/c812956efda7d10dfdce5ae19c0ec8879de38a31
- https://github.com/moodle/moodle
- https://moodle.org/mod/forum/discuss.php?d=275164
- https://web.archive.org/web/20150914064838/http://www.securitytracker.com/id/1031215
- http://git.moodle.org/gw?p=moodle.git&a=search&h=HEAD&st=commit&s=MDL-48019
- http://openwall.com/lists/oss-security/2014/11/17/11
Affected packages
Packagist / moodle/moodle
Package
- Name
- moodle/moodle
- Purl
- pkg:composer/moodle/moodle
Packagist / moodle/moodle
Package
- Name
- moodle/moodle
- Purl
- pkg:composer/moodle/moodle
Packagist / moodle/moodle
Package
- Name
- moodle/moodle
- Purl
- pkg:composer/moodle/moodle