CVE-2015-0214: Moodle allows attackers to bypass a messaging-disabled setting
message/externallib.php in Moodle through 2.5.9, 2.6.x before 2.6.7, 2.7.x before 2.7.4, and 2.8.x before 2.8.2 allows remote authenticated users to bypass a messaging-disabled setting via a web-services request, as demonstrated by a people-search request.
Other sources
Moodle allows attackers to bypass a messaging-disabled setting
— Packagist
Affected Software
Remediation
Recommended actions to resolve this vulnerability, in priority order.
- Upgrade
Upgrade
composer/moodle/moodleto a version that resolves this vulnerability.Fixed in 2.8.2 - Upgrade
Upgrade
composer/moodle/moodleto a version that resolves this vulnerability.Fixed in 2.7.4 - Upgrade
Upgrade
composer/moodle/moodleto a version that resolves this vulnerability.Fixed in 2.6.7 - Upgrade
Upgrade
Moodleto a version that resolves this vulnerability.Fixed in 2.6.7 - Upgrade
Upgrade
Moodleto a version that resolves this vulnerability.Fixed in 2.7.4 - Upgrade
Upgrade
Moodleto a version that resolves this vulnerability.Fixed in 2.8.2
Event History
Frequently Asked Questions
What is the severity of CVE-2015-0214?
CVE-2015-0214 has a medium severity level due to its ability to allow unauthorized access to messaging capabilities.
How do I fix CVE-2015-0214?
To fix CVE-2015-0214, update Moodle to version 2.6.7, 2.7.4, or 2.8.2 or later.
Who is affected by CVE-2015-0214?
CVE-2015-0214 affects Moodle versions 2.5.0 through 2.5.9, 2.6.x up to 2.6.6, 2.7.x up to 2.7.3, and 2.8.x up to 2.8.1.
What specific vulnerability does CVE-2015-0214 exploit?
CVE-2015-0214 exploits a flaw allowing remote authenticated users to bypass messaging disabled settings via web services.
What are the implications of CVE-2015-0214 for Moodle users?
Users of affected Moodle versions may unintentionally expose messaging features to unauthorized users if not patched.