CVE-2014-0009

course/loginas.php in Moodle through 2.2.11, 2.3.x before 2.3.11, 2.4.x before 2.4.8, 2.5.x before 2.5.4, and 2.6.x before 2.6.1 does not enforce the…

published January 20, 2014

CVSS
—
EPSS
1%
Percentile
68.6
In the wild
Unconfirmed
What it is

course/loginas.php in Moodle through 2.2.11, 2.3.x before 2.3.11, 2.4.x before 2.4.8, 2.5.x before 2.5.4, and 2.6.x before 2.6.1 does not enforce the moodle/site:accessallgroups capability requirement for outside-group users in a SEPARATEGROUPS configuration, which allows remote authenticated users to perform "login as" actions via a direct request.

The record
Technical detail
CVSS
Not scored
CVSS v4.0
Not supplied
EPSS
0.01227 · 68.6th percentile
Published
2014-01-20T11:00Z
EPSS history
Timeline
  • 20 JAN 11:00Z
    course/loginas.php in Moodle through 2.2.11, 2.3.x before 2.3.11, 2.4.x before 2.4.8, 2.5.x before 2.5.4, and 2.6.x before 2.6.1 does not enforce the…
    cvelistv5