CVE-2014-7836

Moodle < 2.4.11 and 2.5.x < 2.5.9 - Cross-Site Request Forgery in LTI Module

Title source: llm
STIX 2.1

Description

Multiple cross-site request forgery (CSRF) vulnerabilities in the LTI module in Moodle through 2.4.11, 2.5.x before 2.5.9, 2.6.x before 2.6.6, and 2.7.x before 2.7.3 allow remote attackers to hijack the authentication of arbitrary users for a (1) mod/lti/request_tool.php or (2) mod/lti/instructor_edit_tool_type.php request.

References (4)

Core 4
Core References
Third Party Advisory, VDB Entry vdb-entry x_refsource_sectrack
http://www.securitytracker.com/id/1031215
Mailing List mailing-list x_refsource_mlist
http://openwall.com/lists/oss-security/2014/11/17/11
Vendor Advisory x_refsource_confirm
https://moodle.org/mod/forum/discuss.php?d=275162

Scores

EPSS 0.0017
EPSS Percentile 38.3%

Details

CWE
CWE-352
Status published
Products (20)
moodle/moodle 2.5.0
moodle/moodle 2.5.1
moodle/moodle 2.5.2
moodle/moodle 2.5.3
moodle/moodle 2.5.4
moodle/moodle 2.5.5
moodle/moodle 2.5.6
moodle/moodle 2.5.7
moodle/moodle 2.5.8
moodle/moodle 2.6.0
... and 10 more
Published Nov 24, 2014
Tracked Since Feb 18, 2026