CVE-2015-0217: Moodle allows attackers to cause a denial of service
filter/mediaplugin/filter.php in Moodle through 2.5.9, 2.6.x before 2.6.7, 2.7.x before 2.7.4, and 2.8.x before 2.8.2 allows remote authenticated users to cause a denial of service (CPU consumption or partial outage) via a crafted string that is matched against an improper regular expression.
Other sources
Moodle allows attackers to cause a denial of service
— Packagist
Affected Software
Remediation
Recommended actions to resolve this vulnerability, in priority order.
- Upgrade
Upgrade
composer/moodle/moodleto a version that resolves this vulnerability.Fixed in 2.8.2 - Upgrade
Upgrade
composer/moodle/moodleto a version that resolves this vulnerability.Fixed in 2.7.4 - Upgrade
Upgrade
composer/moodle/moodleto a version that resolves this vulnerability.Fixed in 2.6.7
Event History
Frequently Asked Questions
What is the severity of CVE-2015-0217?
CVE-2015-0217 has a moderate severity level as it allows remote authenticated users to cause denial of service.
How do I fix CVE-2015-0217?
To fix CVE-2015-0217, upgrade your Moodle installation to version 2.8.2 or later, 2.7.4 or later, or 2.6.7.
Which versions of Moodle are affected by CVE-2015-0217?
CVE-2015-0217 affects Moodle versions 2.5.9 and earlier, 2.6.x before 2.6.7, 2.7.x before 2.7.4, and 2.8.x before 2.8.2.
What kind of attack does CVE-2015-0217 enable?
CVE-2015-0217 enables remote authenticated users to launch a denial of service attack through resource exhaustion.
Is CVE-2015-0217 related to regular expressions in Moodle?
Yes, CVE-2015-0217 is caused by improper regular expression matching in the filter/mediaplugin/filter.php file.