GitHub Advisoryadvisory · Packagist
GHSA-m7cc-6vhg-39wr Moodle improper access control
MEDIUM
Official page ↗
- Aliases
- CVE-2015-5331
- Ecosystem
- Packagist
- Packages
- moodle/moodle
- Severity
- Moderate
- CVSS vector
- CVSS:3.0/AV:N/AC:L/PR:L/UI:N/S:U/C:N/I:L/A:N
- Reviewed
- 2023-08-01
Affected packages
• Packagist moodle/moodle: >= 2.9.0, < 2.9.3 → fixed in 2.9.3
Description
Moodle 2.9.x before 2.9.3 does not properly check the contact list before authorizing message transmission, which allows remote authenticated users to bypass intended access restrictions and conduct spam attacks via the messaging API.
Related
Alias · CVE (1)
- CVE-2015-5331 Moodle 2.9.x before 2.9.3 does not properly check the contact list before authorizing message transmission, which allows remote… vulnerability
References
- https://nvd.nist.gov/vuln/detail/CVE-2015-5331 advisory
- https://github.com/moodle/moodle/commit/cd0c9ac87d75b3d893d61df21e3ecfd12c065c1f web
- https://github.com/moodle/moodle package
- https://moodle.org/mod/forum/discuss.php?d=323228 web
- http://git.moodle.org/gw?p=moodle.git&a=search&h=HEAD&st=commit&s=MDL-50426 web