Description
mod/chat/chat_ajax.php in Moodle through 2.3.11, 2.4.x before 2.4.9, 2.5.x before 2.5.5, and 2.6.x before 2.6.2 does not properly check for the mod/chat:chat capability during chat sessions, which allows remote authenticated users to bypass intended access restrictions in opportunistic circumstances by remaining in a chat session after an intra-session capability removal by an administrator.
Remediation
References
Related Vulnerabilities
MySQL Improper Control of Generation of Code ('Code Injection') Vulnerability (CVE-2005-0709)
Oracle JRE CVE-2014-0454 Vulnerability (CVE-2014-0454)
Moodle Improper Validation of Integrity Check Value Vulnerability (CVE-2021-20184)
WordPress Plugin AskApache Firefox Adsense Cross-Site Request Forgery (3.0)
WordPress Plugin Podcast Importer SecondLine SQL Injection (1.3.7)