CoreCVE
Back

MEDIUM

mod/forum/classes/post_form.php in Moodle through 2.3.11, 2.4.x before 2.4.11, 2.5.x before 2.5.7, 2.6.x before 2.6.4, and 2.7.x before 2.7.1 does not enforce the moodle/site:accessallgroups capability requirement before proceeding with a post to all groups, which allows remote authenticated users to bypass intended access restrictions by leveraging two or more group memberships

Published Jul 29, 2014

Description

mod/forum/classes/post_form.php in Moodle through 2.3.11, 2.4.x before 2.4.11, 2.5.x before 2.5.7, 2.6.x before 2.6.4, and 2.7.x before 2.7.1 does not enforce the moodle/site:accessallgroups capability requirement before proceeding with a post to all groups, which allows remote authenticated users to bypass intended access restrictions by leveraging two or more group memberships.

Affected products

Remediation

No remediation recorded yet.

Weaknesses (1)

CWE-264

References (10)

Change history (0)

No recorded changes yet.

Sources
CVE.org / MITRE
Status PUBLISHED
Assigner redhat
Published Jul 29, 2014
Updated Aug 6, 2024
Reserved May 14, 2014
Link CVE-2014-3553
CISA Vulnrichment
Updated n/a
NVD
Status Modified
Modified Jun 17, 2026
Link CVE-2014-3553
Red Hat
Severity n/a
Public date n/a
Links CVE-2014-3553
ENISA EUVD
Assigner redhat
Published Jul 29, 2014
Updated Aug 6, 2024
Exploited since n/a
Link EUVD-2022-4560
EUVD-2022-4560 GHSA-MG69-5Q59-8JCG