PT-2016-1297 · Moodle · Moodle

Marina Glancy · Published 2015-09-23 · Updated 2022-05-13 · CVE-2015-5269

Positive Technologies (AI Summary)

CVSS v3.1

5.4

Medium

Base vector

AV:N/AC:L/PR:L/UI:R/S:C/C:L/I:L/A:N

Name of the Vulnerable Software and Affected Versions Moodle versions 2.6.11 and earlier, 2.7.x before 2.7.10, 2.8.x before 2.8.8, 2.9.x before 2.9.2

Description The issue exists due to insufficient protection of the web page structure in the group/overview.php function of the Moodle learning management system. This allows a remote attacker to inject arbitrary web or HTML code by modifying the grouping description, potentially leading to cross-site scripting (XSS).

Recommendations For versions 2.6.11 and earlier, update to version 2.6.12 or later. For versions 2.7.x before 2.7.10, update to version 2.7.10 or later. For versions 2.8.x before 2.8.8, update to version 2.8.8 or later. For versions 2.9.x before 2.9.2, update to version 2.9.2 or later. As a temporary workaround, consider restricting access to the group/overview.php page until a patch is available. Avoid using modified grouping descriptions in the affected API endpoint until the issue is resolved.

Fix

XSS

Weakness Enumeration

CWE-79

Related Identifiers

BDU:2016-00594

CVE-2015-5269

GHSA-5729-822W-J342

MGASA-2015-0381

Affected Products

Moodle

References · 30

• https://nvd.nist.gov/vuln/detail/CVE-2015-5269 · Security Note
• https://moodle.org/mod/forum/discuss.php?d=320293 · Vendor Advisory
• https://ubuntu.com/security/CVE-2015-5269 · Vendor Advisory
• https://advisories.mageia.org/MGASA-2015-0381.html · Security Note
• https://cve.org/CVERecord?id=CVE-2015-5269 · Security Note
• https://bdu.fstec.ru/vul/2016-00594 · Security Note
• https://osv.dev/vulnerability/MGASA-2015-0381 · Vendor Advisory
• https://osv.dev/vulnerability/UBUNTU-CVE-2015-5269 · Vendor Advisory
• https://osv.dev/vulnerability/GHSA-5729-822w-j342 · Vendor Advisory
• https://github.com/moodle/moodle · Note
• https://github.com/moodle/moodle/commit/ae6b18a9343083c1ab62d6eb535a7112bd7a3a50 · Note
• https://github.com/moodle/moodle/commit/fa5a3cdedcd92bd96881fa89a6ff5efd80bd3512 · Note
• https://github.com/moodle/moodle/commit/45f3b5302d645ba13ca8b68b0106a638ebd21980 · Note
• https://github.com/moodle/moodle/commit/a44fed5c804b52e82c334c37dcc1c12b77f97af8 · Note
• https://moodle.org/mod/forum/discuss.php?d=320289 · Note