VYPR
← All advisories
Moderate severityNVD Advisory· Published May 27, 2014· Updated May 6, 2026

CVE-2014-0213

CVE-2014-0213

Description

Multiple cross-site request forgery (CSRF) vulnerabilities in mod/assign/locallib.php in the Assignment subsystem in Moodle through 2.3.11, 2.4.x before 2.4.10, 2.5.x before 2.5.6, and 2.6.x before 2.6.3 allow remote attackers to hijack the authentication of teachers for quick-grading requests.

Affected packages

Versions sourced from the GitHub Security Advisory.

PackageAffected versionsPatched versions
moodle/moodlePackagist
< 2.4.102.4.10
moodle/moodlePackagist
>= 2.5.0, < 2.5.62.5.6
moodle/moodlePackagist
>= 2.6.0, < 2.6.32.6.3

Patches

4
0cd720fe512d

MDL-44606 assign: disable sesskey protection for unit test.

https://github.com/moodle/moodleDamyon WieseMay 7, 2014via ghsa
commit
1 file changed · +3 −0
  • mod/assign/tests/events_test.php+3 −0 modified
    @@ -472,6 +472,7 @@ public function test_submission_unlocked() {
     }
 
     public function test_submission_graded() {
+        $this->editingteachers[0]->ignoresesskey = true;
         $this->setUser($this->editingteachers[0]);
         $assign = $this->create_instance();
 
@@ -555,6 +556,8 @@ public function test_submission_graded() {
         );
         $this->assertEventLegacyLogData($expected, $event);
         $sink->close();
+        // Revert to defaults.
+        $this->editingteachers[0]->ignoresesskey = false;
     }
 
     /**
436ef91ceb3c

MDL-44606 Assign: Some grading functions are missing sesskey protection

https://github.com/moodle/moodleDamyon WieseMar 13, 2014via ghsa
commit
1 file changed · +3 −0
  • mod/assign/locallib.php+3 −0 modified
    @@ -4392,6 +4392,7 @@ protected function process_save_extension(& $mform) {
 
         // Include extension form.
         require_once($CFG->dirroot . '/mod/assign/extensionform.php');
+        require_sesskey();
 
         // Need submit permission to submit an assignment.
         require_capability('mod/assign:grantextension', $this->context);
@@ -4438,6 +4439,7 @@ protected function process_save_quick_grades() {
 
         // Need grade permission.
         require_capability('mod/assign:grade', $this->context);
+        require_sesskey();
 
         // Make sure advanced grading is disabled.
         $gradingmanager = get_grading_manager($this->get_context(), 'mod_assign', 'submissions');
@@ -4674,6 +4676,7 @@ protected function process_save_grading_options() {
 
         // Need submit permission to submit an assignment.
         require_capability('mod/assign:grade', $this->context);
+        require_sesskey();
 
         // Is advanced grading enabled?
         $gradingmanager = get_grading_manager($this->get_context(), 'mod_assign', 'submissions');
a57eacc114ee

MDL-44606 Assign: Some grading functions are missing sesskey protection

https://github.com/moodle/moodleDamyon WieseMar 13, 2014via ghsa
commit
1 file changed · +3 −0
  • mod/assign/locallib.php+3 −0 modified
    @@ -3728,6 +3728,7 @@ private function process_save_extension(& $mform) {
 
         // Include extension form.
         require_once($CFG->dirroot . '/mod/assign/extensionform.php');
+        require_sesskey();
 
         // Need submit permission to submit an assignment.
         require_capability('mod/assign:grantextension', $this->context);
@@ -3774,6 +3775,7 @@ private function process_save_quick_grades() {
 
         // Need grade permission
         require_capability('mod/assign:grade', $this->context);
+        require_sesskey();
 
         // make sure advanced grading is disabled
         $gradingmanager = get_grading_manager($this->get_context(), 'mod_assign', 'submissions');
@@ -3977,6 +3979,7 @@ private function process_save_grading_options() {
 
         // Need submit permission to submit an assignment
         require_capability('mod/assign:grade', $this->context);
+        require_sesskey();
 
         $mform = new mod_assign_grading_options_form(null, array('cm'=>$this->get_course_module()->id,
                                                                  'contextid'=>$this->context->id,
f977d376c936

MDL-44606 Assign: Some grading functions are missing sesskey protection

https://github.com/moodle/moodleDamyon WieseMar 13, 2014via ghsa
commit
1 file changed · +3 −0
  • mod/assign/locallib.php+3 −0 modified
    @@ -4709,6 +4709,7 @@ protected function process_save_extension(& $mform) {
 
         // Include extension form.
         require_once($CFG->dirroot . '/mod/assign/extensionform.php');
+        require_sesskey();
 
         $batchusers = optional_param('selectedusers', '', PARAM_SEQUENCE);
         $userid = 0;
@@ -4752,6 +4753,7 @@ protected function process_save_quick_grades() {
 
         // Need grade permission.
         require_capability('mod/assign:grade', $this->context);
+        require_sesskey();
 
         // Make sure advanced grading is disabled.
         $gradingmanager = get_grading_manager($this->get_context(), 'mod_assign', 'submissions');
@@ -5045,6 +5047,7 @@ protected function process_save_grading_options() {
 
         // Need submit permission to submit an assignment.
         require_capability('mod/assign:grade', $this->context);
+        require_sesskey();
 
         // Is advanced grading enabled?
         $gradingmanager = get_grading_manager($this->get_context(), 'mod_assign', 'submissions');

Vulnerability mechanics

Generated by null/stub on May 9, 2026. Inputs: CWE entries + fix-commit diffs from this CVE's patches. Citations validated against bundle.

References

8

News mentions

0

No linked articles in our index yet.