CVE-2014-7836
CVE-2014-7836
This page contains facts from public vulnerability sources. Check the original advisory before updating.
Multiple cross-site request forgery (CSRF) vulnerabilities in the LTI module in Moodle through 2.4.11, 2.5.x before 2.5.9, 2.6.x before 2.6.6, and 2.7.x before 2.7.3 allow remote attackers to hijack the authentication of arbitrary users for a (1) mod/lti/request_tool.php or (2) mod/lti/instructor_edit_tool_type.php request.
EPSS 1.0% · Fix available
- Published
- Updated
Stack: php
Affected products and versions
n/a
- Versions
- n/a: Affected
No fix published
moodle/moodle Packagist
- Versions
- v2.3.10
- v2.3.11
- v2.3.4
- v2.3.5
- v2.3.6
- v2.3.7
- v2.3.8
- v2.3.9
- v2.4.0
- v2.4.0-rc1
- v2.4.1
- v2.4.10
- v2.4.11
- v2.4.2
- v2.4.3
- v2.4.4
- v2.4.5
- v2.4.6
- v2.4.7
- v2.4.8
- v2.4.9
- v2.5.0
- v2.5.0-beta
- v2.5.0-rc1
- v2.5.1
- v2.5.2
- v2.5.3
- v2.5.4
- v2.5.5
- v2.5.6
- v2.5.7
- v2.5.8
- Affected ranges
- ECOSYSTEM: < 2.5.9
Update to 2.5.9
moodle/moodle Packagist
- Versions
- v2.6.0
- v2.6.1
- v2.6.2
- v2.6.3
- v2.6.4
- v2.6.5
- Affected ranges
- ECOSYSTEM: ≥ 2.6.0, < 2.6.6
Update to 2.6.6
moodle/moodle Packagist
- Versions
- v2.7.0
- v2.7.1
- v2.7.2
- Affected ranges
- ECOSYSTEM: ≥ 2.7.0, < 2.7.3
Update to 2.7.3