GitHub Advisoryadvisory · Packagist

GHSA-mm9q-3847-m48x Moodle allows attackers to enter additional answer attempts

MEDIUM Published 2022-05-13 Modified 2024-01-26 Official page ↗
Aliases
CVE-2015-5264
Ecosystem
Packagist
Packages
moodle/moodle
Severity
Moderate
CVSS vector
CVSS:3.0/AV:N/AC:L/PR:L/UI:N/S:U/C:L/I:L/A:N
Reviewed
2024-01-26

Affected packages

• Packagist moodle/moodle: >= 2.7.0, < 2.7.10 → fixed in 2.7.10 • Packagist moodle/moodle: >= 2.8.0, < 2.8.8 → fixed in 2.8.8 • Packagist moodle/moodle: >= 2.9.0, < 2.9.2 → fixed in 2.9.2

Description

The lesson module in Moodle through 2.6.11, 2.7.x before 2.7.10, 2.8.x before 2.8.8, and 2.9.x before 2.9.2 allows remote authenticated users to bypass intended access restrictions and enter additional answer attempts by leveraging the student role.

Related

Alias · CVE (1)

  • CVE-2015-5264 The lesson module in Moodle through 2.6.11, 2.7.x before 2.7.10, 2.8.x before 2.8.8, and 2.9.x before 2.9.2 allows remote authenticated… vulnerability

References