VYPR
← All advisories
Medium severity4.3NVD Advisory· Published May 15, 2017· Updated May 13, 2026

CVE-2017-7491

CVE-2017-7491

Description

In Moodle 2.x and 3.x, a CSRF attack is possible that allows attackers to change the "number of courses displayed in the course overview block" configuration setting.

Affected packages

Versions sourced from the GitHub Security Advisory.

PackageAffected versionsPatched versions
moodle/moodlePackagist
>= 3.2, < 3.2.33.2.3
moodle/moodlePackagist
>= 3.1, < 3.1.63.1.6
moodle/moodlePackagist
>= 3.0, < 3.0.103.0.10
moodle/moodlePackagist
>= 2.7, < 2.7.202.7.20

Affected products

53
  • Moodle/Moodle53 versions
    cpe:2.3:a:moodle:moodle:2.7.0:*:*:*:*:*:*:*+ 52 more
    • cpe:2.3:a:moodle:moodle:2.7.0:*:*:*:*:*:*:*
    • cpe:2.3:a:moodle:moodle:2.7.0:beta:*:*:*:*:*:*
    • cpe:2.3:a:moodle:moodle:2.7.0:rc1:*:*:*:*:*:*
    • cpe:2.3:a:moodle:moodle:2.7.0:rc2:*:*:*:*:*:*
    • cpe:2.3:a:moodle:moodle:2.7.1:*:*:*:*:*:*:*
    • cpe:2.3:a:moodle:moodle:2.7.10:*:*:*:*:*:*:*
    • cpe:2.3:a:moodle:moodle:2.7.11:*:*:*:*:*:*:*
    • cpe:2.3:a:moodle:moodle:2.7.12:*:*:*:*:*:*:*
    • cpe:2.3:a:moodle:moodle:2.7.13:*:*:*:*:*:*:*
    • cpe:2.3:a:moodle:moodle:2.7.14:*:*:*:*:*:*:*
    • cpe:2.3:a:moodle:moodle:2.7.15:*:*:*:*:*:*:*
    • cpe:2.3:a:moodle:moodle:2.7.16:*:*:*:*:*:*:*
    • cpe:2.3:a:moodle:moodle:2.7.17:*:*:*:*:*:*:*
    • cpe:2.3:a:moodle:moodle:2.7.18:*:*:*:*:*:*:*
    • cpe:2.3:a:moodle:moodle:2.7.2:*:*:*:*:*:*:*
    • cpe:2.3:a:moodle:moodle:2.7.3:*:*:*:*:*:*:*
    • cpe:2.3:a:moodle:moodle:2.7.4:*:*:*:*:*:*:*
    • cpe:2.3:a:moodle:moodle:2.7.5:*:*:*:*:*:*:*
    • cpe:2.3:a:moodle:moodle:2.7.6:*:*:*:*:*:*:*
    • cpe:2.3:a:moodle:moodle:2.7.7:*:*:*:*:*:*:*
    • cpe:2.3:a:moodle:moodle:2.7.8:*:*:*:*:*:*:*
    • cpe:2.3:a:moodle:moodle:2.7.9:*:*:*:*:*:*:*
    • cpe:2.3:a:moodle:moodle:3.0.0:*:*:*:*:*:*:*
    • cpe:2.3:a:moodle:moodle:3.0.0:beta:*:*:*:*:*:*
    • cpe:2.3:a:moodle:moodle:3.0.0:rc1:*:*:*:*:*:*
    • cpe:2.3:a:moodle:moodle:3.0.0:rc2:*:*:*:*:*:*
    • cpe:2.3:a:moodle:moodle:3.0.0:rc3:*:*:*:*:*:*
    • cpe:2.3:a:moodle:moodle:3.0.0:rc4:*:*:*:*:*:*
    • cpe:2.3:a:moodle:moodle:3.0.1:*:*:*:*:*:*:*
    • cpe:2.3:a:moodle:moodle:3.0.2:*:*:*:*:*:*:*
    • cpe:2.3:a:moodle:moodle:3.0.3:*:*:*:*:*:*:*
    • cpe:2.3:a:moodle:moodle:3.0.4:*:*:*:*:*:*:*
    • cpe:2.3:a:moodle:moodle:3.0.5:*:*:*:*:*:*:*
    • cpe:2.3:a:moodle:moodle:3.0.6:*:*:*:*:*:*:*
    • cpe:2.3:a:moodle:moodle:3.0.7:*:*:*:*:*:*:*
    • cpe:2.3:a:moodle:moodle:3.0.8:*:*:*:*:*:*:*
    • cpe:2.3:a:moodle:moodle:3.1.0:*:*:*:*:*:*:*
    • cpe:2.3:a:moodle:moodle:3.1.0:beta:*:*:*:*:*:*
    • cpe:2.3:a:moodle:moodle:3.1.0:rc1:*:*:*:*:*:*
    • cpe:2.3:a:moodle:moodle:3.1.0:rc2:*:*:*:*:*:*
    • cpe:2.3:a:moodle:moodle:3.1.1:*:*:*:*:*:*:*
    • cpe:2.3:a:moodle:moodle:3.1.2:*:*:*:*:*:*:*
    • cpe:2.3:a:moodle:moodle:3.1.3:*:*:*:*:*:*:*
    • cpe:2.3:a:moodle:moodle:3.1.4:*:*:*:*:*:*:*
    • cpe:2.3:a:moodle:moodle:3.2.0:*:*:*:*:*:*:*
    • cpe:2.3:a:moodle:moodle:3.2.0:beta:*:*:*:*:*:*
    • cpe:2.3:a:moodle:moodle:3.2.0:rc1:*:*:*:*:*:*
    • cpe:2.3:a:moodle:moodle:3.2.0:rc2:*:*:*:*:*:*
    • cpe:2.3:a:moodle:moodle:3.2.0:rc3:*:*:*:*:*:*
    • cpe:2.3:a:moodle:moodle:3.2.0:rc4:*:*:*:*:*:*
    • cpe:2.3:a:moodle:moodle:3.2.0:rc5:*:*:*:*:*:*
    • cpe:2.3:a:moodle:moodle:3.2.1:*:*:*:*:*:*:*
    • cpe:2.3:a:moodle:moodle:3.2.2:*:*:*:*:*:*:*

Patches

0

No patches discovered yet.

Vulnerability mechanics

AI mechanics synthesis has not run for this CVE yet.

References

3

News mentions

0

No linked articles in our index yet.