Track vulnerabilities like this one. Sign up free to get alerted when software you use is affected.
6.8

Moodle Forum Module Allows Hackers to Take Over User Accounts

CVE-2014-7838 · published 11 years ago
Summary

A security issue in Moodle's Forum module lets attackers take control of any user's account by tricking them into clicking a malicious link. This could allow hackers to access sensitive information or make changes to the site. Fix this by updating Moodle to the latest version, especially if you're using version 2.4.11 or earlier, or versions 2.5 to 2.7.3.

What to do
  • Update moodle moodle to version 2.5.9.
  • Update moodle moodle to version 2.6.6.
  • Update moodle moodle to version 2.7.3.
Affected software
Ecosystem VendorProductAffected versions
composer moodle moodle < 2.5.9
>= 2.6.0, < 2.6.6
>= 2.7.0, < 2.7.3
Fix: upgrade to 2.5.9
– moodle moodle <= 2.4.11
2.5.0
2.5.1
2.5.2
2.5.3
2.5.4
2.5.5
2.5.6
2.5.7
2.5.8
2.6.0
2.6.1
7 more version ranges
cpe:2.3:a:moodle:moodle:*:*:*:*:*:*:*:*
Original advisory text
Multiple cross-site request forgery (CSRF) vulnerabilities in the Forum module in Moodle through 2.4.11, 2.5.x before 2.5.9, 2.6.x before 2.6.6, and 2.7.x before 2.7.3 allow remote attackers to hij...
Multiple cross-site request forgery (CSRF) vulnerabilities in the Forum module in Moodle through 2.4.11, 2.5.x before 2.5.9, 2.6.x before 2.6.6, and 2.7.x before 2.7.3 allow remote attackers to hijack the authentication of arbitrary users for requests that set a tracking preference within (1) mod/forum/deprecatedlib.php, (2) mod/forum/forum.js, (3) mod/forum/index.php, or (4) mod/forum/lib.php.
References
Severity
6.8 Medium
Exploitation
1% chance of attack within 30 days
Type
CWE-352Cross-Site Request Forgery (CSRF)
Timeline
Published24 Nov 2014
Updated31 Oct 2026
First seen6 Mar 2026
Sources
GHSA-43r4-vm25-qm78 · GHSA
CVE-2014-7838 · NVD
Track software like this
Free during beta