Description
mod/forum/post.php in Moodle 2.9.x before 2.9.1 does not consider the mod/forum:canposttomygroups capability before authorizing "Post a copy to all groups" actions, which allows remote authenticated users to bypass intended access restrictions by leveraging per-group authorization.
Remediation
References
Related Vulnerabilities
WordPress Plugin Slideshow Gallery LITE Cross-Site Scripting (1.5.3.4)
Jenkins Incorrect Permission Assignment for Critical Resource Vulnerability (CVE-2017-2612)
WordPress Plugin WordPress Popular Posts Cross-Site Scripting (5.3.3)
Oracle Database Server CVE-2014-4290 Vulnerability (CVE-2014-4290)
SugarCRM Improper Input Validation Vulnerability (CVE-2011-0745)