CVE-2009-4301

Description

mnet/lib.php in Moodle 1.8 before 1.8.11 and 1.9 before 1.9.7, when MNET services are enabled, does not properly check permissions, which allows remote authenticated servers to execute arbitrary MNET functions.

Affected Platforms

Weakness Type

CWE-264

References

• http://cvs.moodle.org/moodle/mnet/lib.php?r1=1.16.2.10&r2=1.16.2.11
• http://cvs.moodle.org/moodle/mnet/lib.php?r1=1.9.2.7&r2=1.9.2.8
• http://docs.moodle.org/en/Moodle_1.8.11_release_notes
• http://docs.moodle.org/en/Moodle_1.9.7_release_notes
• http://moodle.org/mod/forum/discuss.php?d=139106
• http://secunia.com/advisories/37614