PT-2016-1308 · Moodle · Moodle

Juan Leyva · Publicado 2015-12-05 · Atualizado 2022-05-13 · CVE-2015-5342

Positive Technologies (AI Summary)

CVSS v3.1

4.3

Média

Vetor base

AV:N/AC:L/PR:L/UI:N/S:U/C:N/I:L/A:N

Name of the Vulnerable Software and Affected Versions Moodle versions 2.6.11 and earlier, 2.7.x through 2.7.10, 2.8.x through 2.8.8, 2.9.x through 2.9.2

Description The issue is related to insufficient access control in the choice module, allowing remote authenticated users to bypass intended access restrictions. This can be achieved by visiting a specific URL to add or delete responses in the closed state.

Recommendations For versions 2.6.11 and earlier, update to version 2.6.12 or later. For versions 2.7.x through 2.7.10, update to version 2.7.11 or later. For versions 2.8.x through 2.8.8, update to version 2.8.9 or later. For versions 2.9.x through 2.9.2, update to version 2.9.3 or later.

Correção

Enumeração de Fraquezas

CWE-264

Identificadores relacionados

BDU:2016-00605

CVE-2015-5342

GHSA-6XPM-Q8X9-J3RW

MGASA-2015-0464

Produtos afetados

Moodle

Referências · 32

• https://github.com/moodle/moodle · Nota
• https://github.com/moodle/moodle/commit/fb2491effb1a7d5d7abb0efba5b3929342990514 · Nota
• https://github.com/moodle/moodle/commit/5c16db4fc561c97b6a907398ea081cdaf6590214 · Nota
• https://github.com/moodle/moodle/commit/7ca8c34045eb0d2031652b452492fe4abb2c7c8a · Nota
• https://github.com/moodle/moodle/commit/02d8c8ca394ba053905f9b87c155042aabf0ce1b · Nota
• https://github.com/moodle/moodle/commit/09bb6f19e5814deb25ae6ceb8270063430b8941f · Nota
• https://github.com/moodle/moodle/commit/bdaa571437c6357f322871b068f02a4520b7a23d · Nota
• https://github.com/moodle/moodle/commit/97394274ee29f0a6eecab330b5bbb8ee335e7ece · Nota
• https://github.com/moodle/moodle/commit/6283c33979001b035f9fc565b869296f66a61c4e · Nota
• https://bugs.mageia.org/show_bug.cgi?id=17280 · Nota
• https://ubuntu.com/security/CVE-2015-5342 · Aviso do Fabricante
• http://git.moodle.org/gw?p=moodle.git&a=search&h=HEAD&st=commit&s=MDL-51569 · Nota
• https://moodle.org/mod/forum/discuss.php?d=323237 · Aviso do Fabricante
• https://moodle.org/mod/forum/discuss.php?d=323229 · Nota
• https://moodle.org/mod/forum/discuss.php?d=323237#p1297708 · Nota