Permissions, Privileges, and Access Controls in Moodle - CVE-2015-5342
Published: February 22, 2016 / Updated: August 9, 2020
Vulnerability identifier: #VU40453
CSH Severity: Low
CVSS v4: 5.3 [CVSS:4.0/AV:N/AC:L/AT:N/PR:L/UI:N/VC:N/VI:L/VA:N/SC:N/SI:N/SA:N]
CVE-ID: CVE-2015-5342
CWE-ID: CWE-264
Exploitation vector: Remote access
Exploit availability:
No public exploit available
Vulnerability details
The vulnerability allows a remote authenticated user to manipulate data.
The choice module in Moodle through 2.6.11, 2.7.x before 2.7.11, 2.8.x before 2.8.9, and 2.9.x before 2.9.3 allows remote authenticated users to bypass intended access restrictions by visiting a URL to add or delete responses in the closed state.
Affected software
Moodle
Fedora
moodle
Fedora
moodle
How to mitigate CVE-2015-5342
Install update from vendor's website.
moodle - addressed in versions 2.7.11-1.el6, 2.8.9-1.fc22, 2.9.3-1.fc23, 3.0-1.el7, 3.0.1-1.el7