Description
mod/lti/ajax.php in Moodle through 2.5.9, 2.6.x before 2.6.7, 2.7.x before 2.7.4, and 2.8.x before 2.8.2 does not consider the moodle/course:manageactivities and mod/lti:addinstance capabilities before proceeding with registered-tool list searches, which allows remote authenticated users to obtain sensitive information via requests to the LTI Ajax service.
Remediation
References
Related Vulnerabilities
MySQL CVE-2020-2679 Vulnerability (CVE-2020-2679)
WordPress Plugin Polo Video Gallery-Best wordpress video gallery Cross-Site Scripting (1.2)
Apache HTTP Server Other Vulnerability (CVE-2005-2728)
Trac CVE-2009-4405 Vulnerability (CVE-2009-4405)
WordPress Plugin Simple Feature Requests Free Unspecified Vulnerability (1.0.4)