PT-2016-1302 · Moodle · Moodle

Hugh Davenport · Published 2015-12-05 · Updated 2022-05-13 · CVE-2015-5336

Positive Technologies (AI Summary)

CVSS v3.1

5.4

Medium

Base vector

AV:N/AC:L/PR:L/UI:R/S:C/C:L/I:L/A:N

Name of the Vulnerable Software and Affected Versions Moodle versions prior to 2.6.11 Moodle versions 2.7.x before 2.7.11 Moodle versions 2.8.x before 2.8.9 Moodle versions 2.9.x before 2.9.3

Description The issue exists due to the lack of protection for the web page structure in the survey module of the Moodle learning management system. This allows a remote attacker, using the student role and a specially crafted survey answer, to inject arbitrary web or HTML code.

Recommendations For versions prior to 2.6.11, update to version 2.6.11 or later. For versions 2.7.x before 2.7.11, update to version 2.7.11 or later. For versions 2.8.x before 2.8.9, update to version 2.8.9 or later. For versions 2.9.x before 2.9.3, update to version 2.9.3 or later.

Fix

XSS

Weakness Enumeration

CWE-79

Related Identifiers

BDU:2016-00599

CVE-2015-5336

GHSA-GRVW-QQ2J-R898

MGASA-2015-0464

Affected Products

Moodle

References · 31

• https://moodle.org/mod/forum/discuss.php?d=323231 · Vendor Advisory
• https://bdu.fstec.ru/vul/2016-00599 · Security Note
• https://nvd.nist.gov/vuln/detail/CVE-2015-5336 · Security Note
• https://cve.org/CVERecord?id=CVE-2015-5336 · Security Note
• https://osv.dev/vulnerability/MGASA-2015-0464 · Vendor Advisory
• https://osv.dev/vulnerability/UBUNTU-CVE-2015-5336 · Vendor Advisory
• https://advisories.mageia.org/MGASA-2015-0464.html · Security Note
• https://osv.dev/vulnerability/GHSA-grvw-qq2j-r898 · Vendor Advisory
• https://ubuntu.com/security/CVE-2015-5336 · Vendor Advisory
• https://github.com/moodle/moodle · Note
• https://github.com/moodle/moodle/commit/31d0bf81af079bc285ea439ac5160f9e45697c88 · Note
• https://github.com/moodle/moodle/commit/86cec86942c1cfcb92b840afd18deed9b9a34951 · Note
• https://github.com/moodle/moodle/commit/b4f4232e1cf76334e4b8dda9cf68962b121e6bc0 · Note
• https://github.com/moodle/moodle/commit/fd14d2902fab15fa6affecc427bb11d3869d9afe · Note
• https://github.com/moodle/moodle/commit/48d8989f13a6320c54b05f7d3ea552356cf85ed6 · Note