CVE-2015-3177: Low severity moodle vulnerability
Published Jun 1, 2015
·Updated
Moodle 2.8.x before 2.8.6 does not consider the tool/monitor:subscribe capability before entering subscriptions to site-wide event-monitor rules, which allows remote authenticated users to obtain sensitive information via a subscription request.
Affected Software
6 affected components
Moodle moodle=2.8.0
Moodle moodle=2.8.1
Moodle moodle=2.8.2
Moodle moodle=2.8.3
Moodle moodle=2.8.4
Moodle moodle=2.8.5
Event History
Jun 1, 2015
CVE Published
via MITRE·07:00 PM
Data Sourced
via MITRE·07:00 PM
Description
Frequently Asked Questions
1
What is the severity of CVE-2015-3177?
CVE-2015-3177 has a moderate severity level due to the potential exposure of sensitive information to remote authenticated users.
2
How do I fix CVE-2015-3177?
To fix CVE-2015-3177, upgrade your Moodle installation to version 2.8.6 or later.
3
Who is affected by CVE-2015-3177?
CVE-2015-3177 affects Moodle versions 2.8.0 to 2.8.5.
4
What types of vulnerabilities are addressed by CVE-2015-3177?
CVE-2015-3177 addresses an improper verification of user permissions vulnerability.
5
Can remote authenticated users exploit CVE-2015-3177?
Yes, remote authenticated users can exploit CVE-2015-3177 to subscribe to sensitive site-wide event-monitor rules.