PT-2016-1289 · Moodle · Moodle

Juan Leyva · Published 2016-02-22 · Updated 2020-12-01 · CVE-2015-3273

Positive Technologies (AI Summary)

CVSS v2.0

4.0

Medium

Base vector

AV:N/AC:L/Au:S/C:N/I:P/A:N

Name of the Vulnerable Software and Affected Versions Moodle versions 2.9.x through 2.9.0

Description The issue is related to insufficient access control in the mod/forum/post.php function of the Moodle learning management system. This can be exploited by a remote attacker to bypass existing access restrictions by leveraging group authorization. The problem arises because the mod/forum:canposttomygroups capability is not properly considered before authorizing certain actions, such as "Post a copy to all groups".

Recommendations For Moodle versions 2.9.x through 2.9.0, update to version 2.9.1 or later to resolve the issue. As a temporary workaround, consider restricting access to the mod/forum/post.php function to minimize the risk of exploitation. Additionally, review and adjust group authorization settings to ensure that access restrictions are properly enforced.

Fix

Weakness Enumeration

CWE-264

Related Identifiers

BDU:2016-00586

CVE-2015-3273

Affected Products

Moodle

References · 8

• https://bdu.fstec.ru/vul/2016-00586 · Security Note
• https://moodle.org/mod/forum/discuss.php?d=316663 · Vendor Advisory
• https://nvd.nist.gov/vuln/detail/CVE-2015-3273 · Security Note
• http://openwall.com/lists/oss-security/2015/07/13/2 · Note
• http://git.moodle.org/gw?p=moodle.git&a=search&h=HEAD&st=commit&s=MDL-50220 · Note
• https://cve.mitre.org/cgi-bin/cvename.cgi?name=CVE-2015-3273 · Note
• http://securitytracker.com/id/1032877 · Note
• http://git.moodle.org/gw?p=moodle.git&a=search&h=HEAD&st=commit&s=MDL-50220 · Note