PT-2015-1576 · Moodle · Moodle

Adrian Greeve · Published 2015-06-01 · Updated 2020-12-01 · CVE-2015-3177

Positive Technologies (AI Summary)

CVSS v2.0

3.5

Low

Base vector

AV:N/AC:M/Au:S/C:P/I:N/A:N

Name of the Vulnerable Software and Affected Versions Moodle versions 2.8.x through 2.8.5

Description The issue is related to errors in the code of the tool/monitor:subscribe component in the Moodle learning management system. This allows a remote authenticated user to obtain sensitive information via a subscription request due to mistakes in the subscription procedure.

Recommendations For Moodle versions 2.8.x through 2.8.5, update to version 2.8.6 or later to resolve the issue.

Fix

Weakness Enumeration

CWE-17

Related Identifiers

BDU:2015-10890

CVE-2015-3177

Affected Products

Moodle

References · 9

• https://moodle.org/mod/forum/discuss.php?d=313684 · Vendor Advisory
• https://nvd.nist.gov/vuln/detail/CVE-2015-3177 · Security Note
• https://bdu.fstec.ru/vul/2015-10890 · Security Note
• http://securityfocus.com/bid/74721 · Note
• https://cve.mitre.org/cgi-bin/cvename.cgi?name=CVE-2015-3177 · Note
• http://git.moodle.org/gw?p=moodle.git&a=search&h=HEAD&st=commit&s=MDL-50039 · Note
• http://openwall.com/lists/oss-security/2015/05/18/1 · Note
• http://git.moodle.org/gw?p=moodle.git&a=search&h=HEAD&st=commit&s=MDL-50039 · Note
• http://securitytracker.com/id/1032358 · Note