Security announcements

MSA-15-0005: Insufficient access check in calendar functions in web-services

 
Picture of Marina Glancy
MSA-15-0005: Insufficient access check in calendar functions in web-services
 
Description: Through web-services it was possible to get information about calendar events which user did not have enough permissions to see
Issue summary: calendar/externallib.php lacks self::validate_context($context);
Severity/Risk: Minor
Versions affected: 2.8 to 2.8.1, 2.7 to 2.7.3, 2.6 to 2.6.6 and earlier unsupported versions
Versions fixed: 2.8.2, 2.7.4 and 2.6.7
Reported by: Petr Skoda
Issue no.: MDL-48017
CVE identifier: CVE-2015-0215
Changes (master): http://git.moodle.org/gw?p=moodle.git&a=search&h=HEAD&st=commit&s=MDL-48017