PT-2015-1608 · Moodle · Moodle

Damyon Wiese · Published 2015-06-01 · Updated 2022-05-13 · CVE-2015-0216

Positive Technologies (AI Summary)

CVSS v2.0

3.5

Low

Base vector

AV:N/AC:M/Au:S/C:N/I:P/A:N

Name of the Vulnerable Software and Affected Versions Moodle versions 2.8.x through 2.8.1

Description The issue allows remote authenticated users to conduct cross-site scripting (XSS) attacks via crafted essay feedback. This is due to the failure to set the RISK XSS bit for graders in the access.php file of the Lesson module. The exploitation of this issue may enable a remote attacker to perform cross-site scripting using the feedback form.

Recommendations For Moodle versions 2.8.x through 2.8.1, update to version 2.8.2 or later to resolve the issue. As a temporary workaround, consider restricting access to the Lesson module's essay feedback feature until the update is applied.

Fix

XSS

Weakness Enumeration

CWE-79

Related Identifiers

BDU:2015-10941

CVE-2015-0216

GHSA-2JCW-R79X-4R5V

Affected Products

Moodle

References · 14

• https://nvd.nist.gov/vuln/detail/CVE-2015-0216 · Security Note
• https://bdu.fstec.ru/vul/2015-10941 · Security Note
• https://moodle.org/mod/forum/discuss.php?d=278616 · Vendor Advisory
• https://osv.dev/vulnerability/UBUNTU-CVE-2015-0216 · Vendor Advisory
• https://cve.org/CVERecord?id=CVE-2015-0216 · Security Note
• https://osv.dev/vulnerability/GHSA-2jcw-r79x-4r5v · Vendor Advisory
• https://ubuntu.com/security/CVE-2015-0216 · Vendor Advisory
• https://github.com/moodle/moodle · Note
• https://github.com/moodle/moodle/commit/b9c86823c70a1cba20bca1c4b5b032ee1559e22d · Note
• https://github.com/moodle/moodle/commit/c80603ddc4ba4e7d85ea2b79f644a4a041cee137 · Note
• http://openwall.com/lists/oss-security/2015/01/19/1 · Note
• http://git.moodle.org/gw?p=moodle.git&a=search&h=HEAD&st=commit&s=MDL-48034 · Note
• http://git.moodle.org/gw?p=moodle.git&a=search&h=HEAD&st=commit&s=MDL-48034 · Note
• https://moodle.org/mod/forum/discuss.php?d=278616#p1196682 · Note