CVE-2015-2270: Moodle allows attackers to obtain sensitive course information
lib/moodlelib.php in Moodle through 2.5.9, 2.6.x before 2.6.9, 2.7.x before 2.7.6, and 2.8.x before 2.8.4, when the theme uses the blocks-regions feature, establishes the course state at an incorrect point in the login-validation process, which allows remote attackers to obtain sensitive course information via unspecified vectors.
Other sources
Moodle allows attackers to obtain sensitive course information
— Packagist
Affected Software
Remediation
Recommended actions to resolve this vulnerability, in priority order.
- Upgrade
Upgrade
composer/moodle/moodleto a version that resolves this vulnerability.Fixed in 2.8.4 - Upgrade
Upgrade
composer/moodle/moodleto a version that resolves this vulnerability.Fixed in 2.7.6 - Upgrade
Upgrade
composer/moodle/moodleto a version that resolves this vulnerability.Fixed in 2.6.9
Event History
Frequently Asked Questions
What is the severity of CVE-2015-2270?
CVE-2015-2270 is considered to have a medium severity level due to the potential exposure of sensitive course information.
How do I fix CVE-2015-2270?
To fix CVE-2015-2270, upgrade to Moodle version 2.8.4, 2.7.6, or 2.6.9 or later.
Which versions are affected by CVE-2015-2270?
CVE-2015-2270 affects Moodle versions up to 2.5.9, all versions prior to 2.6.9, all versions prior to 2.7.6, and all versions prior to 2.8.4.
Who can exploit CVE-2015-2270?
CVE-2015-2270 can be exploited by remote attackers to gain access to sensitive course information.
What components are involved in CVE-2015-2270?
CVE-2015-2270 involves the lib/moodlelib.php file and the blocks-regions feature of Moodle.