CVE-2017-7490
UnknownEPSS 1.05%
Last modified
CVE-2017-7490 is a vulnerability of currently unknown severity. In Moodle 2.x and 3.x, searching of arbitrary blogs is possible because a capability check is missing.. EPSS estimates a 1.05% chance of exploitation in the next 30 days.
Description
In Moodle 2.x and 3.x, searching of arbitrary blogs is possible because a capability check is missing.
Metrics
Weakness Enumeration
Affected Software
| Vendor | Product | Versions |
|---|---|---|
| Moodle | Moodle | 2.7.0 |
| Moodle | Moodle | 2.7.1 |
| Moodle | Moodle | 2.7.2 |
| Moodle | Moodle | 2.7.3 |
| Moodle | Moodle | 2.7.4 |
| Moodle | Moodle | 2.7.5 |
| Moodle | Moodle | 2.7.6 |
| Moodle | Moodle | 2.7.7 |
| Moodle | Moodle | 2.7.8 |
| Moodle | Moodle | 2.7.9 |
| Moodle | Moodle | 2.7.10 |
| Moodle | Moodle | 2.7.11 |
| Moodle | Moodle | 2.7.12 |
| Moodle | Moodle | 2.7.13 |
| Moodle | Moodle | 2.7.14 |
| Moodle | Moodle | 2.7.15 |
| Moodle | Moodle | 2.7.16 |
| Moodle | Moodle | 2.7.17 |
| Moodle | Moodle | 2.7.18 |
| Moodle | Moodle | 3.0.0 |
| Moodle | Moodle | 3.0.1 |
| Moodle | Moodle | 3.0.2 |
| Moodle | Moodle | 3.0.3 |
| Moodle | Moodle | 3.0.4 |
| Moodle | Moodle | 3.0.5 |
| Moodle | Moodle | 3.0.6 |
| Moodle | Moodle | 3.0.7 |
| Moodle | Moodle | 3.0.8 |
| Moodle | Moodle | 3.1.0 |
| Moodle | Moodle | 3.1.1 |
| Moodle | Moodle | 3.1.2 |
| Moodle | Moodle | 3.1.3 |
| Moodle | Moodle | 3.1.4 |
| Moodle | Moodle | 3.2.0 |
| Moodle | Moodle | 3.2.1 |
| Moodle | Moodle | 3.2.2 |
References
- https://moodle.org/mod/forum/discuss.php?d=352354Patch, Vendor Advisory
- https://moodle.org/mod/forum/discuss.php?d=352354Patch, Vendor Advisory
Timeline
- Published
- Last Modified
- Status
- Modified
Frequently Asked Questions
What is CVE-2017-7490?
In Moodle 2.x and 3.x, searching of arbitrary blogs is possible because a capability check is missing.
How severe is CVE-2017-7490?
Severity scoring for CVE-2017-7490 is pending analysis. The EPSS model estimates a 1.05% probability of exploitation in the next 30 days.
How do I fix CVE-2017-7490?
Check the vendor references and advisories linked above for patched versions and mitigation guidance. You can also run a Strix scan to test if your systems are affected.
How Strix Helps
- How Strix found a critical auth bypass in etcdStrix autonomously discovered a critical authentication bypass in etcd, later designated CVE-2026-33413.
- Autonomous PentestingAI agents that find and validate exploitable vulnerabilities like this one across your applications.
- PR ReviewsPentest every pull request so vulnerable code is caught before it ships to production.
- AI Penetration TestingHow AI-driven penetration testing continuously covers your attack surface.
Related CVEs from 2017
- CVE-2017-7484It was found that some selectivity estimation functions in P…
- CVE-2017-7485In PostgreSQL 9.3.x before 9.3.17, 9.4.x before 9.4.12, 9.5.…
- CVE-2017-7486PostgreSQL versions 8.4 - 9.6 are vulnerable to information …
- CVE-2017-7487The ipxitf_ioctl function in net/ipx/af_ipx.c in the Linux k…7.8
- CVE-2017-7488Authconfig version 6.2.8 is vulnerable to an Information exp…
- CVE-2017-7489In Moodle 2.x and 3.x, remote authenticated users can take o…
- CVE-2017-7491In Moodle 2.x and 3.x, a CSRF attack is possible that allows…
- CVE-2017-7492Rejected reason: DO NOT USE THIS CANDIDATE NUMBER. ConsultID…
- CVE-2017-7493Quick Emulator (Qemu) built with the VirtFS, host directory …7.8
- CVE-2017-7494Samba since version 3.5.0 and before 4.6.4, 4.5.10 and 4.4.1…9.8
- CVE-2017-7495fs/ext4/inode.c in the Linux kernel before 4.6.2, when ext4 …
- CVE-2017-7496fedora-arm-installer up to and including 1.99.16 is vulnerab…
Are you affected by CVE-2017-7490?
Run a free Strix scan to check your systems for this vulnerability.
Scan your code nowSource: NVD / NIST