CVE-2015-3273

mod/forum/post.php in Moodle 2.9.x before 2.9.1 does not consider the mod/forum:canposttomygroups capability before authorizing "Post a copy to all groups"…

published February 22, 2016

CVSS
—
EPSS
2%
Percentile
74.1
In the wild
Unconfirmed
What it is

mod/forum/post.php in Moodle 2.9.x before 2.9.1 does not consider the mod/forum:canposttomygroups capability before authorizing "Post a copy to all groups" actions, which allows remote authenticated users to bypass intended access restrictions by leveraging per-group authorization.

The record
Technical detail
CVSS
Not scored
CVSS v4.0
Not supplied
EPSS
0.01500 · 74.1th percentile
Published
2016-02-22T02:00Z
EPSS history
Timeline
  • 22 FEB 02:00Z
    mod/forum/post.php in Moodle 2.9.x before 2.9.1 does not consider the mod/forum:canposttomygroups capability before authorizing "Post a copy to all groups"…
    cvelistv5