Lucene search

[email protected]CVE-2014-0122

HistoryMar 24, 2014 - 2:20 p.m.

CVE-2014-0122

2014-03-2414:20:39

CWE-264

[email protected]

web.nvd.nist.gov

cve-2014-0122

moodle

chat_ajax.php

security vulnerability

access control

nvd

4.9 Medium

CVSS2

Attack Vector

NETWORK

Attack Complexity

MEDIUM

Authentication

SINGLE

Confidentiality Impact

PARTIAL

Integrity Impact

PARTIAL

Availability Impact

NONE

AV:N/AC:M/Au:S/C:P/I:P/A:N

6.1 Medium

AI Score

Confidence

Low

0.001 Low

EPSS

Percentile

46.7%

JSON

mod/chat/chat_ajax.php in Moodle through 2.3.11, 2.4.x before 2.4.9, 2.5.x before 2.5.5, and 2.6.x before 2.6.2 does not properly check for the mod/chat:chat capability during chat sessions, which allows remote authenticated users to bypass intended access restrictions in opportunistic circumstances by remaining in a chat session after an intra-session capability removal by an administrator.

Affected configurations

NVD

Node

moodlemoodleRange≤2.3.11

moodlemoodleMatch2.0.0

moodlemoodleMatch2.0.1

moodlemoodleMatch2.0.2

moodlemoodleMatch2.0.3

moodlemoodleMatch2.0.4

moodlemoodleMatch2.0.5

moodlemoodleMatch2.0.6

moodlemoodleMatch2.0.7

moodlemoodleMatch2.0.8

moodlemoodleMatch2.0.9

moodlemoodleMatch2.1.0

moodlemoodleMatch2.1.1

moodlemoodleMatch2.1.2

moodlemoodleMatch2.1.3

moodlemoodleMatch2.1.4

moodlemoodleMatch2.1.5

moodlemoodleMatch2.1.6

moodlemoodleMatch2.1.7

moodlemoodleMatch2.1.8

moodlemoodleMatch2.1.9

moodlemoodleMatch2.1.10

moodlemoodleMatch2.2.0

moodlemoodleMatch2.2.1

moodlemoodleMatch2.2.2

moodlemoodleMatch2.2.3

moodlemoodleMatch2.2.4

moodlemoodleMatch2.2.5

moodlemoodleMatch2.2.6

moodlemoodleMatch2.2.7

moodlemoodleMatch2.2.8

moodlemoodleMatch2.2.9

moodlemoodleMatch2.2.10

moodlemoodleMatch2.2.11

moodlemoodleMatch2.3.0

moodlemoodleMatch2.3.1

moodlemoodleMatch2.3.2

moodlemoodleMatch2.3.3

moodlemoodleMatch2.3.4

moodlemoodleMatch2.3.5

moodlemoodleMatch2.3.6

moodlemoodleMatch2.3.7

moodlemoodleMatch2.3.8

moodlemoodleMatch2.3.9

moodlemoodleMatch2.3.10

moodlemoodleMatch2.4.0

moodlemoodleMatch2.4.1

moodlemoodleMatch2.4.2

moodlemoodleMatch2.4.3

moodlemoodleMatch2.4.4

moodlemoodleMatch2.4.5

moodlemoodleMatch2.4.6

moodlemoodleMatch2.4.7

moodlemoodleMatch2.4.8

moodlemoodleMatch2.5.0

moodlemoodleMatch2.5.1

moodlemoodleMatch2.5.2

moodlemoodleMatch2.5.3

moodlemoodleMatch2.5.4

moodlemoodleMatch2.6.0

moodlemoodleMatch2.6.1

CPENameOperatorVersion
moodle:moodlemoodlele2.3.11
moodle:moodlemoodleeq2.0.0
moodle:moodlemoodleeq2.0.1
moodle:moodlemoodleeq2.0.2
moodle:moodlemoodleeq2.0.3
moodle:moodlemoodleeq2.0.4
moodle:moodlemoodleeq2.0.5
moodle:moodlemoodleeq2.0.6
moodle:moodlemoodleeq2.0.7
moodle:moodlemoodleeq2.0.8

CPE	Name	Operator	Version
moodle:moodle	moodle	le	2.3.11
moodle:moodle	moodle	eq	2.0.0
moodle:moodle	moodle	eq	2.0.1
moodle:moodle	moodle	eq	2.0.2
moodle:moodle	moodle	eq	2.0.3
moodle:moodle	moodle	eq	2.0.4
moodle:moodle	moodle	eq	2.0.5
moodle:moodle	moodle	eq	2.0.6
moodle:moodle	moodle	eq	2.0.7
moodle:moodle	moodle	eq	2.0.8