Description

Multiple cross-site request forgery (CSRF) vulnerabilities in the LTI module in Moodle through 2.4.11, 2.5.x before 2.5.9, 2.6.x before 2.6.6, and 2.7.x before 2.7.3 allow remote attackers to hijack the authentication of arbitrary users for a (1) mod/lti/request_tool.php or (2) mod/lti/instructor_edit_tool_type.php request.

Remediation

References

CVE-2014-7836

Related Vulnerabilities

WordPress Plugin WP-Property-WordPress Powered Real Estate and Property Management SQL Injection (1.36.0)

WordPress Plugin Copy or Move Comments Multiple Vulnerabilities (1.0.0)

PHP Integer Overflow or Wraparound Vulnerability (CVE-2019-11039)

WordPress Plugin WooCommerce Salesforce Integration Cross-Site Scripting (1.5.8)

Magento Improper Neutralization of Input During Web Page Generation ('Cross-site Scripting') Vulnerability (CVE-2021-21023)

Severity

Medium

Classification

CVE-2014-7836 CWE-352

Tags

Missing Update Known Vulnerabilities