CVE-2014-3553 Moodle does not enforce the moodle/site:accessallgroups capability requirement

Medium 4.9 Published 29 Jul 2014 Updated 6 Aug 2024

Authenticated users can bypass group access restrictions in Moodle forums by leveraging multiple group memberships to post to unauthorized groups.

Exploited in the wild: Not known
Login needed: Any signed-in user
Attackable: Over the internet
Victim action needed: Not needed
Fix: Available

What is CVE-2014-3553?

CVE-2014-3553 is a medium-severity missing authorization vulnerability in Moodle Moodle, published on 29 Jul 2014. Any signed-in user can exploit it over the network, with no action from the victim.

Official description

mod/forum/classes/post_form.php in Moodle through 2.3.11, 2.4.x before 2.4.11, 2.5.x before 2.5.7, 2.6.x before 2.6.4, and 2.7.x before 2.7.1 does not enforce the moodle/site:accessallgroups capability requirement before proceeding with a post to all groups, which allows remote authenticated users to bypass intended access restrictions by leveraging two or more group memberships.

Weakness: CWE-264

Which versions are affected by CVE-2014-3553?

6 open source packages ship an affected version, including moodle/moodle. It affects 1 product.

Package	Affected	Fixed in
`moodle/moodle` Packagist	All versions	`2.5.7`
`moodle/moodle` Packagist	All versions	`2.5.7`
`moodle/moodle` Packagist	From `2.6.0`	`2.6.4`
`moodle/moodle` Packagist	From `2.6.0`	`2.6.4`
`moodle/moodle` Packagist	From `2.7.0`	`2.7.1`
`moodle/moodle` Packagist	From `2.7.0`	`2.7.1`

Products include Moodle Moodle.

How do I fix CVE-2014-3553?

Upgrade moodle/moodle to a fixed version for your release line: 2.5.7, 2.6.4 or 2.7.1.

Upgrade, and check permissions on every request on the server, not only in the interface. More about Missing authorization.

Is CVE-2014-3553 being exploited?

There is no known exploitation of CVE-2014-3553 in the wild and no public exploit code.

All Moodle Moodle vulnerabilities

Sources

Also known as GHSA-mg69-5q59-8jcg.