Moodle does not enforce the moodle/site:accessallgroups capability requirement
Impact
mod/forum/classes/post_form.php in Moodle through 2.3.11, 2.4.x before 2.4.11, 2.5.x before 2.5.7, 2.6.x before 2.6.4, and 2.7.x before 2.7.1 does not enforce the moodle/site:accessallgroups capability requirement before proceeding with a post to all groups, which allows remote authenticated users to bypass intended access restrictions by leveraging two or more group memberships.
Source excerpt · OSVAffected packages
Start with the recorded fix for your release branch. Check your installed version and test compatibility before upgrading. Fixing this advisory does not rule out other vulnerabilities in the release.
| Affected range | Recorded fix |
|---|---|
| Earlier releases before 2.5.7Ecosystem versions | 2.5.7 |
| From 2.6.0 before 2.6.4Ecosystem versions | 2.6.4 |
| From 2.7.0 before 2.7.1Ecosystem versions | 2.7.1 |
Version evidence: OSV · GHSA-mg69-5q59-8jcg
View original version evidence (35 explicit versions)
Original source description
mod/forum/classes/post_form.php in Moodle through 2.3.11, 2.4.x before 2.4.11, 2.5.x before 2.5.7, 2.6.x before 2.6.4, and 2.7.x before 2.7.1 does not enforce the moodle/site:accessallgroups capability requirement before proceeding with a post to all groups, which allows remote authenticated users to bypass intended access restrictions by leveraging two or more group memberships.
References
- Security advisory nvd.nist.gov/vuln/detail/CVE-2014-3553
- Patch github.com/moodle/moodle/commit/5c74e0daca748ffbbbf17a410abd8c85335b2116
- Patch github.com/moodle/moodle/commit/91c8d4da71a6706c70071f9182e8ae6110c86d70
- Patch github.com/moodle/moodle/commit/e3fd900dcda7b603d7e0749008abd0d01290bbc3
- Patch github.com/moodle/moodle/commit/f2946a5419a94f19cb3490a249fe0bb50161f254
- Source reference github.com/moodle/moodle
- Source reference moodle.org/mod/forum/discuss.php
- Source reference git.moodle.org/gw
- Security advisory openwall.com/lists/oss-security/2014/07/21/1