Description

lib/db/access.php in Moodle 2.0.x before 2.0.4 and 2.1.x before 2.1.1 assigns incorrect capabilities to the course-creator role, which allows remote authenticated users to modify course filters by leveraging this role.

Remediation

References

CVE-2011-4296

Related Vulnerabilities

MediaWiki Exposure of Sensitive Information to an Unauthorized Actor Vulnerability (CVE-2026-58026)

Lighttpd Exposure of Sensitive Information to an Unauthorized Actor Vulnerability (CVE-2008-4359)

WordPress Plugin Qtranslate Slug Cross-Site Request Forgery (1.1.18)

Oracle JRE CVE-2019-2958 Vulnerability (CVE-2019-2958)

Apache HTTP Server Improper Neutralization of Escape, Meta, or Control Sequences Vulnerability (CVE-2024-47252)

Severity

Medium

Tags

Missing Update Known Vulnerabilities CWE-264 CVE-2011-4296