CVE-2014-7832
Vulnerability from cvelistv5
Published
2014-11-24 11:00
Modified
2024-08-06 13:03
Severity ?
Summary
mod/lti/launch.php in the LTI module in Moodle through 2.4.11, 2.5.x before 2.5.9, 2.6.x before 2.6.6, and 2.7.x before 2.7.3 performs access control at the course level rather than at the activity level, which allows remote authenticated users to bypass the mod/lti:view capability requirement by viewing an activity instance.
Impacted products
Vendor Product Version
Show details on NVD website


{
  "containers": {
    "adp": [
      {
        "providerMetadata": {
          "dateUpdated": "2024-08-06T13:03:27.260Z",
          "orgId": "af854a3a-2127-422b-91ae-364da2661108",
          "shortName": "CVE"
        },
        "references": [
          {
            "name": "1031215",
            "tags": [
              "vdb-entry",
              "x_refsource_SECTRACK",
              "x_transferred"
            ],
            "url": "http://www.securitytracker.com/id/1031215"
          },
          {
            "name": "[oss-security] 20141117 Moodle security issues are now public",
            "tags": [
              "mailing-list",
              "x_refsource_MLIST",
              "x_transferred"
            ],
            "url": "http://openwall.com/lists/oss-security/2014/11/17/11"
          },
          {
            "tags": [
              "x_refsource_CONFIRM",
              "x_transferred"
            ],
            "url": "http://git.moodle.org/gw?p=moodle.git\u0026a=search\u0026h=HEAD\u0026st=commit\u0026s=MDL-47921"
          },
          {
            "tags": [
              "x_refsource_CONFIRM",
              "x_transferred"
            ],
            "url": "https://moodle.org/mod/forum/discuss.php?d=275154"
          }
        ],
        "title": "CVE Program Container"
      }
    ],
    "cna": {
      "affected": [
        {
          "product": "n/a",
          "vendor": "n/a",
          "versions": [
            {
              "status": "affected",
              "version": "n/a"
            }
          ]
        }
      ],
      "datePublic": "2014-11-17T00:00:00",
      "descriptions": [
        {
          "lang": "en",
          "value": "mod/lti/launch.php in the LTI module in Moodle through 2.4.11, 2.5.x before 2.5.9, 2.6.x before 2.6.6, and 2.7.x before 2.7.3 performs access control at the course level rather than at the activity level, which allows remote authenticated users to bypass the mod/lti:view capability requirement by viewing an activity instance."
        }
      ],
      "problemTypes": [
        {
          "descriptions": [
            {
              "description": "n/a",
              "lang": "en",
              "type": "text"
            }
          ]
        }
      ],
      "providerMetadata": {
        "dateUpdated": "2015-04-29T18:57:00",
        "orgId": "53f830b8-0a3f-465b-8143-3b8a9948e749",
        "shortName": "redhat"
      },
      "references": [
        {
          "name": "1031215",
          "tags": [
            "vdb-entry",
            "x_refsource_SECTRACK"
          ],
          "url": "http://www.securitytracker.com/id/1031215"
        },
        {
          "name": "[oss-security] 20141117 Moodle security issues are now public",
          "tags": [
            "mailing-list",
            "x_refsource_MLIST"
          ],
          "url": "http://openwall.com/lists/oss-security/2014/11/17/11"
        },
        {
          "tags": [
            "x_refsource_CONFIRM"
          ],
          "url": "http://git.moodle.org/gw?p=moodle.git\u0026a=search\u0026h=HEAD\u0026st=commit\u0026s=MDL-47921"
        },
        {
          "tags": [
            "x_refsource_CONFIRM"
          ],
          "url": "https://moodle.org/mod/forum/discuss.php?d=275154"
        }
      ],
      "x_legacyV4Record": {
        "CVE_data_meta": {
          "ASSIGNER": "secalert@redhat.com",
          "ID": "CVE-2014-7832",
          "STATE": "PUBLIC"
        },
        "affects": {
          "vendor": {
            "vendor_data": [
              {
                "product": {
                  "product_data": [
                    {
                      "product_name": "n/a",
                      "version": {
                        "version_data": [
                          {
                            "version_value": "n/a"
                          }
                        ]
                      }
                    }
                  ]
                },
                "vendor_name": "n/a"
              }
            ]
          }
        },
        "data_format": "MITRE",
        "data_type": "CVE",
        "data_version": "4.0",
        "description": {
          "description_data": [
            {
              "lang": "eng",
              "value": "mod/lti/launch.php in the LTI module in Moodle through 2.4.11, 2.5.x before 2.5.9, 2.6.x before 2.6.6, and 2.7.x before 2.7.3 performs access control at the course level rather than at the activity level, which allows remote authenticated users to bypass the mod/lti:view capability requirement by viewing an activity instance."
            }
          ]
        },
        "problemtype": {
          "problemtype_data": [
            {
              "description": [
                {
                  "lang": "eng",
                  "value": "n/a"
                }
              ]
            }
          ]
        },
        "references": {
          "reference_data": [
            {
              "name": "1031215",
              "refsource": "SECTRACK",
              "url": "http://www.securitytracker.com/id/1031215"
            },
            {
              "name": "[oss-security] 20141117 Moodle security issues are now public",
              "refsource": "MLIST",
              "url": "http://openwall.com/lists/oss-security/2014/11/17/11"
            },
            {
              "name": "http://git.moodle.org/gw?p=moodle.git\u0026a=search\u0026h=HEAD\u0026st=commit\u0026s=MDL-47921",
              "refsource": "CONFIRM",
              "url": "http://git.moodle.org/gw?p=moodle.git\u0026a=search\u0026h=HEAD\u0026st=commit\u0026s=MDL-47921"
            },
            {
              "name": "https://moodle.org/mod/forum/discuss.php?d=275154",
              "refsource": "CONFIRM",
              "url": "https://moodle.org/mod/forum/discuss.php?d=275154"
            }
          ]
        }
      }
    }
  },
  "cveMetadata": {
    "assignerOrgId": "53f830b8-0a3f-465b-8143-3b8a9948e749",
    "assignerShortName": "redhat",
    "cveId": "CVE-2014-7832",
    "datePublished": "2014-11-24T11:00:00",
    "dateReserved": "2014-10-03T00:00:00",
    "dateUpdated": "2024-08-06T13:03:27.260Z",
    "state": "PUBLISHED"
  },
  "dataType": "CVE_RECORD",
  "dataVersion": "5.1",
  "vulnerability-lookup:meta": {
    "fkie_nvd": {
      "configurations": "[{\"nodes\": [{\"operator\": \"OR\", \"negate\": false, \"cpeMatch\": [{\"vulnerable\": true, \"criteria\": \"cpe:2.3:a:moodle:moodle:*:*:*:*:*:*:*:*\", \"versionEndIncluding\": \"2.4.11\", \"matchCriteriaId\": \"54F15A46-7242-4EAE-986E-9A7DBE7724ED\"}, {\"vulnerable\": true, \"criteria\": \"cpe:2.3:a:moodle:moodle:2.5.0:*:*:*:*:*:*:*\", \"matchCriteriaId\": \"CD1B5B42-ECA9-4888-B18E-AD8D282311DB\"}, {\"vulnerable\": true, \"criteria\": \"cpe:2.3:a:moodle:moodle:2.5.1:*:*:*:*:*:*:*\", \"matchCriteriaId\": \"9EF03304-032C-4E85-A802-7CDAC89216FA\"}, {\"vulnerable\": true, \"criteria\": \"cpe:2.3:a:moodle:moodle:2.5.2:*:*:*:*:*:*:*\", \"matchCriteriaId\": \"311BEFF3-A58A-4CA8-BE09-F8D081EA13A8\"}, {\"vulnerable\": true, \"criteria\": \"cpe:2.3:a:moodle:moodle:2.5.3:*:*:*:*:*:*:*\", \"matchCriteriaId\": \"D7D2A1F8-82FF-4C1A-A872-71D93874EEAD\"}, {\"vulnerable\": true, \"criteria\": \"cpe:2.3:a:moodle:moodle:2.5.4:*:*:*:*:*:*:*\", \"matchCriteriaId\": \"86E79BB0-6017-441C-9B10-00E55FDF0986\"}, {\"vulnerable\": true, \"criteria\": \"cpe:2.3:a:moodle:moodle:2.5.5:*:*:*:*:*:*:*\", \"matchCriteriaId\": \"CA845882-C0F4-4522-94B2-9AA21A08887A\"}, {\"vulnerable\": true, \"criteria\": \"cpe:2.3:a:moodle:moodle:2.5.6:*:*:*:*:*:*:*\", \"matchCriteriaId\": \"48F341A8-0AC8-4033-8C99-0249B7289F9E\"}, {\"vulnerable\": true, \"criteria\": \"cpe:2.3:a:moodle:moodle:2.5.7:*:*:*:*:*:*:*\", \"matchCriteriaId\": \"4CE1A520-762B-4A35-8075-ED4ECA0A1CB3\"}, {\"vulnerable\": true, \"criteria\": \"cpe:2.3:a:moodle:moodle:2.5.8:*:*:*:*:*:*:*\", \"matchCriteriaId\": \"9803CBE2-80A6-47EB-A782-CC8F1E66FBD9\"}, {\"vulnerable\": true, \"criteria\": \"cpe:2.3:a:moodle:moodle:2.6.0:*:*:*:*:*:*:*\", \"matchCriteriaId\": \"05112EC5-3AAA-499B-8763-345187529C09\"}, {\"vulnerable\": true, \"criteria\": \"cpe:2.3:a:moodle:moodle:2.6.1:*:*:*:*:*:*:*\", \"matchCriteriaId\": \"71407960-077B-4407-B249-789436687D91\"}, {\"vulnerable\": true, \"criteria\": \"cpe:2.3:a:moodle:moodle:2.6.2:*:*:*:*:*:*:*\", \"matchCriteriaId\": \"72728F94-D408-4CAD-A214-800B1D1C7971\"}, {\"vulnerable\": true, \"criteria\": \"cpe:2.3:a:moodle:moodle:2.6.3:*:*:*:*:*:*:*\", \"matchCriteriaId\": \"33C1E9B5-6B2B-4230-92F2-EC0FB307ECF4\"}, {\"vulnerable\": true, \"criteria\": \"cpe:2.3:a:moodle:moodle:2.6.4:*:*:*:*:*:*:*\", \"matchCriteriaId\": \"6925A366-37EB-41ED-85C8-B56D6A93D4EB\"}, {\"vulnerable\": true, \"criteria\": \"cpe:2.3:a:moodle:moodle:2.6.5:*:*:*:*:*:*:*\", \"matchCriteriaId\": \"A6400F9D-9654-444F-9EBB-0F73025AD744\"}, {\"vulnerable\": true, \"criteria\": \"cpe:2.3:a:moodle:moodle:2.7.0:*:*:*:*:*:*:*\", \"matchCriteriaId\": \"4E051AAC-EB40-491F-AF0E-EE8143C12567\"}, {\"vulnerable\": true, \"criteria\": \"cpe:2.3:a:moodle:moodle:2.7.1:*:*:*:*:*:*:*\", \"matchCriteriaId\": \"FADBE87F-1855-453B-B958-0CB8A7908A06\"}, {\"vulnerable\": true, \"criteria\": \"cpe:2.3:a:moodle:moodle:2.7.2:*:*:*:*:*:*:*\", \"matchCriteriaId\": \"1B53A7D2-BDA2-4185-97C3-977A04876A37\"}]}]}]",
      "descriptions": "[{\"lang\": \"en\", \"value\": \"mod/lti/launch.php in the LTI module in Moodle through 2.4.11, 2.5.x before 2.5.9, 2.6.x before 2.6.6, and 2.7.x before 2.7.3 performs access control at the course level rather than at the activity level, which allows remote authenticated users to bypass the mod/lti:view capability requirement by viewing an activity instance.\"}, {\"lang\": \"es\", \"value\": \"mod/lti/launch.php en el m\\u00f3dulo LTI en Moodle hasta 2.4.11, 2.5.x anterior a 2.5.9, 2.6.x anterior a 2.6.6, y 2.7.x anterior a 2.7.3 realiza el control de acceso a nivel de curso en lugar de a nivel de actividad, lo que permite a usuarios remotos autenticados evadir el requisito de la funcionalidad mod/lti:view mediante la visualizaci\\u00f3n de una instancia de la actividad.\"}]",
      "id": "CVE-2014-7832",
      "lastModified": "2024-11-21T02:18:06.077",
      "metrics": "{\"cvssMetricV2\": [{\"source\": \"nvd@nist.gov\", \"type\": \"Primary\", \"cvssData\": {\"version\": \"2.0\", \"vectorString\": \"AV:N/AC:L/Au:S/C:P/I:N/A:N\", \"baseScore\": 4.0, \"accessVector\": \"NETWORK\", \"accessComplexity\": \"LOW\", \"authentication\": \"SINGLE\", \"confidentialityImpact\": \"PARTIAL\", \"integrityImpact\": \"NONE\", \"availabilityImpact\": \"NONE\"}, \"baseSeverity\": \"MEDIUM\", \"exploitabilityScore\": 8.0, \"impactScore\": 2.9, \"acInsufInfo\": false, \"obtainAllPrivilege\": false, \"obtainUserPrivilege\": false, \"obtainOtherPrivilege\": false, \"userInteractionRequired\": false}]}",
      "published": "2014-11-24T11:59:02.600",
      "references": "[{\"url\": \"http://git.moodle.org/gw?p=moodle.git\u0026a=search\u0026h=HEAD\u0026st=commit\u0026s=MDL-47921\", \"source\": \"secalert@redhat.com\"}, {\"url\": \"http://openwall.com/lists/oss-security/2014/11/17/11\", \"source\": \"secalert@redhat.com\"}, {\"url\": \"http://www.securitytracker.com/id/1031215\", \"source\": \"secalert@redhat.com\"}, {\"url\": \"https://moodle.org/mod/forum/discuss.php?d=275154\", \"source\": \"secalert@redhat.com\", \"tags\": [\"Vendor Advisory\"]}, {\"url\": \"http://git.moodle.org/gw?p=moodle.git\u0026a=search\u0026h=HEAD\u0026st=commit\u0026s=MDL-47921\", \"source\": \"af854a3a-2127-422b-91ae-364da2661108\"}, {\"url\": \"http://openwall.com/lists/oss-security/2014/11/17/11\", \"source\": \"af854a3a-2127-422b-91ae-364da2661108\"}, {\"url\": \"http://www.securitytracker.com/id/1031215\", \"source\": \"af854a3a-2127-422b-91ae-364da2661108\"}, {\"url\": \"https://moodle.org/mod/forum/discuss.php?d=275154\", \"source\": \"af854a3a-2127-422b-91ae-364da2661108\", \"tags\": [\"Vendor Advisory\"]}]",
      "sourceIdentifier": "secalert@redhat.com",
      "vulnStatus": "Modified",
      "weaknesses": "[{\"source\": \"nvd@nist.gov\", \"type\": \"Primary\", \"description\": [{\"lang\": \"en\", \"value\": \"CWE-264\"}]}]"
    },
    "nvd": "{\"cve\":{\"id\":\"CVE-2014-7832\",\"sourceIdentifier\":\"secalert@redhat.com\",\"published\":\"2014-11-24T11:59:02.600\",\"lastModified\":\"2024-11-21T02:18:06.077\",\"vulnStatus\":\"Modified\",\"cveTags\":[],\"descriptions\":[{\"lang\":\"en\",\"value\":\"mod/lti/launch.php in the LTI module in Moodle through 2.4.11, 2.5.x before 2.5.9, 2.6.x before 2.6.6, and 2.7.x before 2.7.3 performs access control at the course level rather than at the activity level, which allows remote authenticated users to bypass the mod/lti:view capability requirement by viewing an activity instance.\"},{\"lang\":\"es\",\"value\":\"mod/lti/launch.php en el m\u00f3dulo LTI en Moodle hasta 2.4.11, 2.5.x anterior a 2.5.9, 2.6.x anterior a 2.6.6, y 2.7.x anterior a 2.7.3 realiza el control de acceso a nivel de curso en lugar de a nivel de actividad, lo que permite a usuarios remotos autenticados evadir el requisito de la funcionalidad mod/lti:view mediante la visualizaci\u00f3n de una instancia de la actividad.\"}],\"metrics\":{\"cvssMetricV2\":[{\"source\":\"nvd@nist.gov\",\"type\":\"Primary\",\"cvssData\":{\"version\":\"2.0\",\"vectorString\":\"AV:N/AC:L/Au:S/C:P/I:N/A:N\",\"baseScore\":4.0,\"accessVector\":\"NETWORK\",\"accessComplexity\":\"LOW\",\"authentication\":\"SINGLE\",\"confidentialityImpact\":\"PARTIAL\",\"integrityImpact\":\"NONE\",\"availabilityImpact\":\"NONE\"},\"baseSeverity\":\"MEDIUM\",\"exploitabilityScore\":8.0,\"impactScore\":2.9,\"acInsufInfo\":false,\"obtainAllPrivilege\":false,\"obtainUserPrivilege\":false,\"obtainOtherPrivilege\":false,\"userInteractionRequired\":false}]},\"weaknesses\":[{\"source\":\"nvd@nist.gov\",\"type\":\"Primary\",\"description\":[{\"lang\":\"en\",\"value\":\"CWE-264\"}]}],\"configurations\":[{\"nodes\":[{\"operator\":\"OR\",\"negate\":false,\"cpeMatch\":[{\"vulnerable\":true,\"criteria\":\"cpe:2.3:a:moodle:moodle:*:*:*:*:*:*:*:*\",\"versionEndIncluding\":\"2.4.11\",\"matchCriteriaId\":\"54F15A46-7242-4EAE-986E-9A7DBE7724ED\"},{\"vulnerable\":true,\"criteria\":\"cpe:2.3:a:moodle:moodle:2.5.0:*:*:*:*:*:*:*\",\"matchCriteriaId\":\"CD1B5B42-ECA9-4888-B18E-AD8D282311DB\"},{\"vulnerable\":true,\"criteria\":\"cpe:2.3:a:moodle:moodle:2.5.1:*:*:*:*:*:*:*\",\"matchCriteriaId\":\"9EF03304-032C-4E85-A802-7CDAC89216FA\"},{\"vulnerable\":true,\"criteria\":\"cpe:2.3:a:moodle:moodle:2.5.2:*:*:*:*:*:*:*\",\"matchCriteriaId\":\"311BEFF3-A58A-4CA8-BE09-F8D081EA13A8\"},{\"vulnerable\":true,\"criteria\":\"cpe:2.3:a:moodle:moodle:2.5.3:*:*:*:*:*:*:*\",\"matchCriteriaId\":\"D7D2A1F8-82FF-4C1A-A872-71D93874EEAD\"},{\"vulnerable\":true,\"criteria\":\"cpe:2.3:a:moodle:moodle:2.5.4:*:*:*:*:*:*:*\",\"matchCriteriaId\":\"86E79BB0-6017-441C-9B10-00E55FDF0986\"},{\"vulnerable\":true,\"criteria\":\"cpe:2.3:a:moodle:moodle:2.5.5:*:*:*:*:*:*:*\",\"matchCriteriaId\":\"CA845882-C0F4-4522-94B2-9AA21A08887A\"},{\"vulnerable\":true,\"criteria\":\"cpe:2.3:a:moodle:moodle:2.5.6:*:*:*:*:*:*:*\",\"matchCriteriaId\":\"48F341A8-0AC8-4033-8C99-0249B7289F9E\"},{\"vulnerable\":true,\"criteria\":\"cpe:2.3:a:moodle:moodle:2.5.7:*:*:*:*:*:*:*\",\"matchCriteriaId\":\"4CE1A520-762B-4A35-8075-ED4ECA0A1CB3\"},{\"vulnerable\":true,\"criteria\":\"cpe:2.3:a:moodle:moodle:2.5.8:*:*:*:*:*:*:*\",\"matchCriteriaId\":\"9803CBE2-80A6-47EB-A782-CC8F1E66FBD9\"},{\"vulnerable\":true,\"criteria\":\"cpe:2.3:a:moodle:moodle:2.6.0:*:*:*:*:*:*:*\",\"matchCriteriaId\":\"05112EC5-3AAA-499B-8763-345187529C09\"},{\"vulnerable\":true,\"criteria\":\"cpe:2.3:a:moodle:moodle:2.6.1:*:*:*:*:*:*:*\",\"matchCriteriaId\":\"71407960-077B-4407-B249-789436687D91\"},{\"vulnerable\":true,\"criteria\":\"cpe:2.3:a:moodle:moodle:2.6.2:*:*:*:*:*:*:*\",\"matchCriteriaId\":\"72728F94-D408-4CAD-A214-800B1D1C7971\"},{\"vulnerable\":true,\"criteria\":\"cpe:2.3:a:moodle:moodle:2.6.3:*:*:*:*:*:*:*\",\"matchCriteriaId\":\"33C1E9B5-6B2B-4230-92F2-EC0FB307ECF4\"},{\"vulnerable\":true,\"criteria\":\"cpe:2.3:a:moodle:moodle:2.6.4:*:*:*:*:*:*:*\",\"matchCriteriaId\":\"6925A366-37EB-41ED-85C8-B56D6A93D4EB\"},{\"vulnerable\":true,\"criteria\":\"cpe:2.3:a:moodle:moodle:2.6.5:*:*:*:*:*:*:*\",\"matchCriteriaId\":\"A6400F9D-9654-444F-9EBB-0F73025AD744\"},{\"vulnerable\":true,\"criteria\":\"cpe:2.3:a:moodle:moodle:2.7.0:*:*:*:*:*:*:*\",\"matchCriteriaId\":\"4E051AAC-EB40-491F-AF0E-EE8143C12567\"},{\"vulnerable\":true,\"criteria\":\"cpe:2.3:a:moodle:moodle:2.7.1:*:*:*:*:*:*:*\",\"matchCriteriaId\":\"FADBE87F-1855-453B-B958-0CB8A7908A06\"},{\"vulnerable\":true,\"criteria\":\"cpe:2.3:a:moodle:moodle:2.7.2:*:*:*:*:*:*:*\",\"matchCriteriaId\":\"1B53A7D2-BDA2-4185-97C3-977A04876A37\"}]}]}],\"references\":[{\"url\":\"http://git.moodle.org/gw?p=moodle.git\u0026a=search\u0026h=HEAD\u0026st=commit\u0026s=MDL-47921\",\"source\":\"secalert@redhat.com\"},{\"url\":\"http://openwall.com/lists/oss-security/2014/11/17/11\",\"source\":\"secalert@redhat.com\"},{\"url\":\"http://www.securitytracker.com/id/1031215\",\"source\":\"secalert@redhat.com\"},{\"url\":\"https://moodle.org/mod/forum/discuss.php?d=275154\",\"source\":\"secalert@redhat.com\",\"tags\":[\"Vendor Advisory\"]},{\"url\":\"http://git.moodle.org/gw?p=moodle.git\u0026a=search\u0026h=HEAD\u0026st=commit\u0026s=MDL-47921\",\"source\":\"af854a3a-2127-422b-91ae-364da2661108\"},{\"url\":\"http://openwall.com/lists/oss-security/2014/11/17/11\",\"source\":\"af854a3a-2127-422b-91ae-364da2661108\"},{\"url\":\"http://www.securitytracker.com/id/1031215\",\"source\":\"af854a3a-2127-422b-91ae-364da2661108\"},{\"url\":\"https://moodle.org/mod/forum/discuss.php?d=275154\",\"source\":\"af854a3a-2127-422b-91ae-364da2661108\",\"tags\":[\"Vendor Advisory\"]}]}}"
  }
}


Log in or create an account to share your comment.




Tags
Taxonomy of the tags.


Loading…

Loading…

Loading…

Sightings

Author Source Type Date

Nomenclature

  • Seen: The vulnerability was mentioned, discussed, or seen somewhere by the user.
  • Confirmed: The vulnerability is confirmed from an analyst perspective.
  • Exploited: This vulnerability was exploited and seen by the user reporting the sighting.
  • Patched: This vulnerability was successfully patched by the user reporting the sighting.
  • Not exploited: This vulnerability was not exploited or seen by the user reporting the sighting.
  • Not confirmed: The user expresses doubt about the veracity of the vulnerability.
  • Not patched: This vulnerability was not successfully patched by the user reporting the sighting.