PT-2016-1299 · Moodle · Moodle

Pavel Sokolov · Publicado 2016-02-22 · Atualizado 2022-05-13 · CVE-2015-5331

Positive Technologies (AI Summary)

CVSS v3.1

4.3

Média

Vetor base

AV:N/AC:L/PR:L/UI:N/S:U/C:N/I:L/A:N

Name of the Vulnerable Software and Affected Versions Moodle versions 2.9.x through 2.9.2

Description The issue is related to errors in checking the contact list, allowing a remote attacker to bypass existing access restrictions and conduct spam attacks. The messaging API is affected, enabling remote authenticated users to exploit this issue.

Recommendations For Moodle versions 2.9.x through 2.9.2, update to version 2.9.3 or later to resolve the issue. As a temporary workaround, consider restricting access to the messaging API to minimize the risk of exploitation.

Correção

Enumeração de Fraquezas

CWE-254

Identificadores relacionados

BDU:2016-00596

CVE-2015-5331

GHSA-M7CC-6VHG-39WR

Produtos afetados

Moodle

Referências · 8

• https://github.com/moodle/moodle · Nota
• https://github.com/moodle/moodle/commit/cd0c9ac87d75b3d893d61df21e3ecfd12c065c1f · Nota
• https://moodle.org/mod/forum/discuss.php?d=323228 · Aviso do Fabricante
• https://nvd.nist.gov/vuln/detail/CVE-2015-5331 · Nota de Segurança
• http://git.moodle.org/gw?p=moodle.git&a=search&h=HEAD&st=commit&s=MDL-50426 · Nota
• http://git.moodle.org/gw?p=moodle.git&a=search&h=HEAD&st=commit&s=MDL-50426 · Nota
• https://osv.dev/vulnerability/GHSA-m7cc-6vhg-39wr · Aviso do Fabricante
• https://bdu.fstec.ru/vul/2016-00596 · Nota de Segurança