PT-2016-1301 · Moodle · Moodle

Andrew Davis · Published 2015-12-05 · Updated 2022-05-13 · CVE-2015-5335

Positive Technologies (AI Summary)

CVSS v3.1

4.3

Medium

Base vector

AV:N/AC:L/PR:N/UI:R/S:U/C:L/I:N/A:N

Name of the Vulnerable Software and Affected Versions Moodle versions prior to 2.6.11 Moodle versions 2.7.x before 2.7.11 Moodle versions 2.8.x before 2.8.9 Moodle versions 2.9.x before 2.9.3

Description A cross-site request forgery (CSRF) issue affects the admin/registration/register.php file, allowing remote attackers to hijack the authentication of administrators for requests that send statistics to an arbitrary hub URL. This can enable an attacker to impersonate a user during a session by sending a request with statistics to any URL.

Recommendations For versions prior to 2.6.11, update to version 2.6.11 or later. For versions 2.7.x before 2.7.11, update to version 2.7.11 or later. For versions 2.8.x before 2.8.9, update to version 2.8.9 or later. For versions 2.9.x before 2.9.3, update to version 2.9.3 or later.

Fix

CSRF

Information Disclosure

Weakness Enumeration

CWE-352

CWE-200

Related Identifiers

BDU:2016-00598

CVE-2015-5335

GHSA-HPMV-WVQ3-GJ27

MGASA-2015-0464

Affected Products

Moodle

References · 28

• https://nvd.nist.gov/vuln/detail/CVE-2015-5335 · Security Note
• https://moodle.org/mod/forum/discuss.php?d=323230 · Vendor Advisory
• https://osv.dev/vulnerability/MGASA-2015-0464 · Vendor Advisory
• https://osv.dev/vulnerability/UBUNTU-CVE-2015-5335 · Vendor Advisory
• https://osv.dev/vulnerability/GHSA-hpmv-wvq3-gj27 · Vendor Advisory
• https://advisories.mageia.org/MGASA-2015-0464.html · Security Note
• https://bdu.fstec.ru/vul/2016-00598 · Security Note
• https://cve.org/CVERecord?id=CVE-2015-5335 · Security Note
• https://ubuntu.com/security/CVE-2015-5335 · Vendor Advisory
• https://github.com/moodle/moodle · Note
• https://github.com/moodle/moodle/commit/4bb9e1ad8af12b01499c68543e80f7c12fd557ea · Note
• https://github.com/moodle/moodle/commit/a1168a7427f8fa1926a771fe8e6d10aeb6689686 · Note
• https://github.com/moodle/moodle/commit/7bf5c6a542efa113dbb241a113cb6079f0572443 · Note
• https://github.com/moodle/moodle/commit/77e072ebec68ba685551b886b71054d1feae6c94 · Note
• https://bugs.mageia.org/show_bug.cgi?id=17280 · Note