Permissions, Privileges, and Access Controls in Moodle - CVE-2015-5272

CSH
CYBERSECURITY HELP
Sign In REGISTER
 
Main Vulnerability Database Vulnerabilities #VU40463

Permissions, Privileges, and Access Controls in Moodle - CVE-2015-5272

Published: February 22, 2016 / Updated: August 9, 2020


Vulnerability identifier: #VU40463
CSH Severity: Low
CVSS v4: 5.3 [CVSS:4.0/AV:N/AC:L/AT:N/PR:L/UI:N/VC:N/VI:L/VA:N/SC:N/SI:N/SA:N]
CVE-ID: CVE-2015-5272
CWE-ID: CWE-264
Exploitation vector: Remote access
Exploit availability: No public exploit available

Vulnerability details

The vulnerability allows a remote authenticated user to manipulate data.

The Forum module in Moodle 2.7.x before 2.7.10 allows remote authenticated users to post to arbitrary groups by leveraging the teacher role, as demonstrated by a post directed to "all participants."


Affected software

Moodle
Fedora
moodle

How to mitigate CVE-2015-5272

Install update from vendor's website.

moodle - addressed in versions 2.7.11-1.el6, 2.8.9-1.fc22, 2.9.3-1.fc23, 3.0-1.el7, 3.0.1-1.el7

External References

Related Security Bulletins