Every CVESearch/Get API key

CVE-2014-3553

Moodle does not enforce the moodle/site:accessallgroups capability requirement

4.9 MediumFix available

CVE-2014-3553 is a medium vulnerability (CVSS 4.9) in Moodle, published July 29, 2014. No source lists public exploit code. EPSS puts the chance of exploitation in the next 30 days at 1.02%, the 63rd percentile. Fixed in moodle/moodle 2.5.7.

Severity
4.9 MediumCVSS 2.0, NVD
Exploit chance
1.02%EPSS, 63rd percentile
Exploitation
None knownNot on CISA’s or ENISA’s lists
Fixed in
2.5.7moodle/moodle +7 more

Description

mod/forum/classes/post_form.php in Moodle through 2.3.11, 2.4.x before 2.4.11, 2.5.x before 2.5.7, 2.6.x before 2.6.4, and 2.7.x before 2.7.1 does not enforce the moodle/site:accessallgroups capability requirement before proceeding with a post to all groups, which allows remote authenticated users to bypass intended access restrictions by leveraging two or more group memberships.

Exploit likelihood

1.02%Unchanged since Feb 4, 2022
90%50%10%1%

Affected products

Affected packages

Affected packages
PackageAffectedFixed
moodle/moodle
Packagist
before 2.5.7
2.5.7
moodle/moodle
Packagist
2.6.0 up to 2.6.4
2.6.4
moodle/moodle
Packagist
2.7.0 up to 2.7.1
2.7.1
moodle/moodle
Packagist
before 2.5.7, plus listed versions
v2.3.10v2.3.11v2.3.4v2.3.5v2.3.6
Show 25 moreShow less
v2.3.7v2.3.8v2.3.9v2.4.0v2.4.0-rc1v2.4.1v2.4.10v2.4.11v2.4.2v2.4.3v2.4.4v2.4.5v2.4.6v2.4.7v2.4.8v2.4.9v2.5.0v2.5.0-betav2.5.0-rc1v2.5.1v2.5.2v2.5.3v2.5.4v2.5.5v2.5.6
2.5.7
moodle/moodle
Packagist
2.6.0 up to 2.6.4, plus listed versions
v2.6.0v2.6.1v2.6.2v2.6.3
2.6.4
moodle/moodle
Packagist
2.7.0 up to 2.7.1, plus listed versions
v2.7.0
2.7.1
moodle
Mageia:3
From an advisory covering 10 CVEs
before 2.6.4-1.mga3
2.6.4-1.mga3
moodle
Mageia:4
From an advisory covering 10 CVEs
before 2.6.4-1.mga4
2.6.4-1.mga4

What each source reports

NVD Score used4.9

mod/forum/classes/post_form.php in Moodle through 2.3.11, 2.4.x before 2.4.11, 2.5.x before 2.5.7, 2.6.x before 2.6.4, and 2.7.x before 2.7.1 does not enforce the moodle/site:accessallgroups capability requirement before proceeding with a post to all groups, which allows remote authenticated users to bypass intended access restrictions by leveraging two or more group memberships.

Record
CVE-2014-3553
CVSS 2.0
4.9 MediumAV:N/AC:M/Au:S/C:P/I:P/A:N
Weakness
CWE-264
Updated
2026-11-02
CVE ListNo score

mod/forum/classes/post_form.php in Moodle through 2.3.11, 2.4.x before 2.4.11, 2.5.x before 2.5.7, 2.6.x before 2.6.4, and 2.7.x before 2.7.1 does not enforce the moodle/site:accessallgroups capability requirement before proceeding with a post to all groups, which allows remote authenticated users to bypass intended access restrictions by leveraging two or more group memberships.

Record
CVE-2014-3553
Updated
2026-11-02
EUVDEUVD-2022-4560No score

mod/forum/classes/post_form.php in Moodle through 2.3.11, 2.4.x before 2.4.11, 2.5.x before 2.5.7, 2.6.x before 2.6.4, and 2.7.x before 2.7.1 does not enforce the moodle/site:accessallgroups capability requirement before proceeding with a post to all groups, which allows remote authenticated users to bypass intended access restrictions by leveraging two or more group memberships.

Record
EUVD-2022-4560
Updated
2026-11-03
GitHub AdvisoriesGHSA-mg69-5q59-8jcgNo score

Moodle does not enforce the moodle/site:accessallgroups capability requirement

mod/forum/classes/post_form.php in Moodle through 2.3.11, 2.4.x before 2.4.11, 2.5.x before 2.5.7, 2.6.x before 2.6.4, and 2.7.x before 2.7.1 does not enforce the moodle/site:accessallgroups capability requirement before proceeding with a post to all groups, which allows remote authenticated users to bypass intended access restrictions by leveraging two or more group memberships.

Record
GHSA-mg69-5q59-8jcg
Updated
2026-11-02
OSVGHSA-mg69-5q59-8jcgNo score

Moodle does not enforce the moodle/site:accessallgroups capability requirement

mod/forum/classes/post_form.php in Moodle through 2.3.11, 2.4.x before 2.4.11, 2.5.x before 2.5.7, 2.6.x before 2.6.4, and 2.7.x before 2.7.1 does not enforce the moodle/site:accessallgroups capability requirement before proceeding with a post to all groups, which allows remote authenticated users to bypass intended access restrictions by leveraging two or more group memberships.

Record
GHSA-mg69-5q59-8jcg
Updated
2026-11-02
OSVMGASA-2014-0308No score

Updated moodle package fixes security vulnerabilities

In Moodle before 2.6.4, serialised data passed by repositories could potentially contain objects defined by add-ons that could include executable code (CVE-2014-3541).

In Moodle before 2.6.4, it was possible for manipulated XML files passed from LTI servers to be interpreted by Moodle to allow access to server-side files (CVE-2014-3542).

In Moodle before 2.6.4, it was possible for manipulated XML files to be uploaded to the IMSCC course format or the IMSCP resource to allow access to server-side files (CVE-2014-3543).

In Moodle before 2.6.4, filtering of the Skype profile field was not removing potentially harmful code (CVE-2014-3544).

In Moodle before 2.6.4, it was possible to inject code into Calculated questions that would be executed on the server (CVE-2014-3545).

In Moodle before 2.6.4, it was possible to get limited user information, such as user name and courses, by manipulating the URL of profile and notes pages (CVE-2014-3546).

In Moodle before 2.6.4, the details of badges from external sources were not being filtered (CVE-2014-3547).

In Moodle before 2.6.4, content of exception dialogues presented from AJAX calls was not being escaped before being presented to users (CVE-2014-3548).

In Moodle before 2.6.4, fields in rubrics were not being correctly filtered (CVE-2014-3551).

In Moodle before 2.6.4, forum was allowing users who were members of more than one group to post to all groups without the capability to access all groups (CVE-2014-3553).

The moodle package has been updated to version 2.6.4, to fix these issues and other bugs.

Record
MGASA-2014-0308
Updated
2026-11-02

History

History
RecordedChangedSources
affected, facts
aliasesEUVD
first indexedCVE List, GitHub Advisories, NVD, OSV

Dates are when Every CVE recorded each change. Upstream dates may differ.

References

Show 16 moreShow less
PagesAll vulnerabilitiesBrowseDocsSourcesGuideGet API key
MoveEnter Open