CVEvulnerability
CVE-2015-5331
4.3 MEDIUM
Official page ↗
- Status
- Modified
- Published
- 2016-02-22
- Last modified
- 2026-06-17
- Assigner
- [email protected]
- CVSS 3.0 ([email protected])
- 4.3 MEDIUM — CVSS:3.0/AV:N/AC:L/PR:L/UI:N/S:U/C:N/I:L/A:N
- CVSS 2.0 ([email protected])
- 4.0 MEDIUM — AV:N/AC:L/Au:S/C:N/I:P/A:N
- Weaknesses
- CWE-254
Description
Moodle 2.9.x before 2.9.3 does not properly check the contact list before authorizing message transmission, which allows remote authenticated users to bypass intended access restrictions and conduct spam attacks via the messaging API.
Affected configurations
• moodle moodle 2.9.0
• moodle moodle 2.9.1
• moodle moodle 2.9.2
Related
Weakness · not in database (1)
References
- http://git.moodle.org/gw?p=moodle.git&a=search&h=HEAD&st=commit&s=MDL-50426 git.moodle.org
- https://moodle.org/mod/forum/discuss.php?d=323228 Vendor Advisory
- http://git.moodle.org/gw?p=moodle.git&a=search&h=HEAD&st=commit&s=MDL-50426 git.moodle.org
- https://moodle.org/mod/forum/discuss.php?d=323228 Vendor Advisory