Description
mod/data/edit.php in Moodle through 2.4.11, 2.5.x before 2.5.9, 2.6.x before 2.6.6, and 2.7.x before 2.7.3 sets a certain group ID to zero upon a database-entry change, which allows remote authenticated users to obtain sensitive information by accessing the database after an edit by a teacher.
Remediation
References
Related Vulnerabilities
PostgreSQL Permissions, Privileges, and Access Controls Vulnerability (CVE-2012-0866)
Oracle Database Server CVE-2006-3699 Vulnerability (CVE-2006-3699)
WordPress Plugin Floating Social Bar Cross-Site Scripting (1.1.5)
WordPress Plugin Simple Download Monitor Cross-Site Scripting (3.5.3)
Artifactory Insufficient Verification of Data Authenticity Vulnerability (CVE-2018-19971)