CVE-2015-0215: Moodle allows attackers to obtain sensitive calendar-event information
calendar/externallib.php in Moodle through 2.5.9, 2.6.x before 2.6.7, 2.7.x before 2.7.4, and 2.8.x before 2.8.2 allows remote authenticated users to obtain sensitive calendar-event information via a web-services request.
Other sources
Moodle allows attackers to obtain sensitive calendar-event information
— Packagist
Affected Software
Remediation
Recommended actions to resolve this vulnerability, in priority order.
- Upgrade
Upgrade
composer/moodle/moodleto a version that resolves this vulnerability.Fixed in 2.8.2 - Upgrade
Upgrade
composer/moodle/moodleto a version that resolves this vulnerability.Fixed in 2.7.4 - Upgrade
Upgrade
composer/moodle/moodleto a version that resolves this vulnerability.Fixed in 2.6.7
Event History
Frequently Asked Questions
What is the severity of CVE-2015-0215?
CVE-2015-0215 is classified as a medium severity vulnerability affecting Moodle.
How do I fix CVE-2015-0215?
To resolve CVE-2015-0215, upgrade to Moodle version 2.6.7, 2.7.4, or 2.8.2 or later.
Who is affected by CVE-2015-0215?
CVE-2015-0215 affects remote authenticated users of Moodle versions 2.5.0 through 2.8.0.
What type of vulnerability is CVE-2015-0215?
CVE-2015-0215 is an information disclosure vulnerability that allows users to access sensitive calendar-event information.
Can I still use older versions of Moodle with CVE-2015-0215?
Using older versions of Moodle impacted by CVE-2015-0215 is not recommended due to security risks.