PT-2015-1606 · Moodle · Moodle

Juan Leyva · Published 2015-01-20 · Updated 2022-05-13 · CVE-2015-0214

Positive Technologies (AI Summary)

CVSS v2.0

4.0

Medium

Base vector

AV:N/AC:L/Au:S/C:N/I:P/A:N

Name of the Vulnerable Software and Affected Versions Moodle versions 2.5.9 and earlier Moodle versions 2.6.x before 2.6.7 Moodle versions 2.7.x before 2.7.4 Moodle versions 2.8.x before 2.8.2

Description The issue is related to insufficient access control in the message/externallib.php component of the Moodle learning management system. This allows a remote authenticated user to bypass the messaging-disabled setting by sending a specially crafted web-services request. For example, this can be achieved through a people-search request.

Recommendations For Moodle versions 2.5.9 and earlier, update to version 2.6.7 or later. For Moodle versions 2.6.x before 2.6.7, update to version 2.6.7 or later. For Moodle versions 2.7.x before 2.7.4, update to version 2.7.4 or later. For Moodle versions 2.8.x before 2.8.2, update to version 2.8.2 or later.

Fix

Weakness Enumeration

CWE-264

Related Identifiers

BDU:2015-10939

CVE-2015-0214

GHSA-4JM2-C9JR-6PRF

MGASA-2015-0032

Affected Products

Moodle

References · 27

• https://nvd.nist.gov/vuln/detail/CVE-2015-0214 · Security Note
• https://moodle.org/mod/forum/discuss.php?d=278614 · Vendor Advisory
• https://osv.dev/vulnerability/GHSA-4jm2-c9jr-6prf · Vendor Advisory
• https://cve.org/CVERecord?id=CVE-2015-0214 · Security Note
• https://osv.dev/vulnerability/MGASA-2015-0032 · Vendor Advisory
• https://osv.dev/vulnerability/UBUNTU-CVE-2015-0214 · Vendor Advisory
• https://advisories.mageia.org/MGASA-2015-0032.html · Security Note
• https://bdu.fstec.ru/vul/2015-10939 · Security Note
• https://ubuntu.com/security/CVE-2015-0214 · Vendor Advisory
• https://github.com/moodle/moodle · Note
• https://github.com/moodle/moodle/commits/v2.6.7#:~:text=MDL%2D48106%20mod_glossary%3A%20Add%20missing%20sesskey%20checks · Note
• https://github.com/moodle/moodle/commit/436bbf8975f0daef329c6483ec595dbf9b39ee56 · Note
• https://github.com/moodle/moodle/commit/5770e5147838aa06a3ecdff6fc3aebbbd17fff90 · Note
• https://github.com/moodle/moodle/commit/c4250ef4f23776ff4862d2860b6be2cf7b2d85f6 · Note
• http://openwall.com/lists/oss-security/2015/01/19/1 · Note