Search for vulnerabilities
Vulnerability details: VCID-8ukr-jeu9-17ej
Vulnerability ID VCID-8ukr-jeu9-17ej
Aliases CVE-2014-7846
GHSA-468q-9cmp-76wc
Summary Moodle does not consider the moodle/tag:edit capability before adding a tag tag/tag_autocomplete.php in Moodle through 2.4.11, 2.5.x before 2.5.9, 2.6.x before 2.6.6, and 2.7.x before 2.7.3 does not consider the moodle/tag:edit capability before adding a tag, which allows remote authenticated users to bypass intended access restrictions via an AJAX request.
Status Published
Exploitability 0.5
Weighted Severity 6.2
Risk 3.1
Affected and Fixed Packages Package Details
Weaknesses (3)
CWE-1035 OWASP Top Ten 2017 Category A9 - Using Components with Known Vulnerabilities
CWE-264 Permissions, Privileges, and Access Controls
CWE-937 OWASP Top Ten 2013 Category A9 - Using Components with Known Vulnerabilities
System Score Found at
generic_textual MODERATE http://git.moodle.org/gw?p=moodle.git&a=search&h=HEAD&st=commit&s=MDL-47965
generic_textual MODERATE http://openwall.com/lists/oss-security/2014/11/17/11
epss 0.00243 https://api.first.org/data/v1/epss?cve=CVE-2014-7846
epss 0.00243 https://api.first.org/data/v1/epss?cve=CVE-2014-7846
cvssv3.1_qr MODERATE https://github.com/advisories/GHSA-468q-9cmp-76wc
generic_textual MODERATE https://github.com/moodle/moodle
generic_textual MODERATE https://github.com/moodle/moodle/commit/1d9e0857f8bd9f21d25886f77cc13120f9d6be08
generic_textual MODERATE https://github.com/moodle/moodle/commit/932694ca59413ce8a0546b8bfb97e07e3b4cf17b
generic_textual MODERATE https://github.com/moodle/moodle/commit/bb69623c5c0754467f01f916f94446e1caddb6a8
generic_textual MODERATE https://moodle.org/mod/forum/discuss.php?d=275157
generic_textual MODERATE https://nvd.nist.gov/vuln/detail/CVE-2014-7846
generic_textual MODERATE https://web.archive.org/web/20150914064838/http://www.securitytracker.com/id/1031215
Reference id Reference type URL
http://git.moodle.org/gw?p=moodle.git&a=search&h=HEAD&st=commit&s=MDL-47965
http://openwall.com/lists/oss-security/2014/11/17/11
https://api.first.org/data/v1/epss?cve=CVE-2014-7846
https://github.com/moodle/moodle
https://github.com/moodle/moodle/commit/1d9e0857f8bd9f21d25886f77cc13120f9d6be08
https://github.com/moodle/moodle/commit/932694ca59413ce8a0546b8bfb97e07e3b4cf17b
https://github.com/moodle/moodle/commit/bb69623c5c0754467f01f916f94446e1caddb6a8
https://moodle.org/mod/forum/discuss.php?d=275157
https://nvd.nist.gov/vuln/detail/CVE-2014-7846
https://web.archive.org/web/20150914064838/http://www.securitytracker.com/id/1031215
GHSA-468q-9cmp-76wc https://github.com/advisories/GHSA-468q-9cmp-76wc
No exploits are available.
Exploit Prediction Scoring System (EPSS)
Percentile 0.47496
EPSS Score 0.00243
Published At June 30, 2025, 12:55 p.m.
Date Actor Action Source VulnerableCode Version
2025-07-01T12:29:53.944527+00:00 GithubOSV Importer Import https://github.com/github/advisory-database/blob/main/advisories/github-reviewed/2022/05/GHSA-468q-9cmp-76wc/GHSA-468q-9cmp-76wc.json 36.1.3