CVE-2015-5265: Moodle allows attackers to delete files
Moodle allows attackers to delete files
Other sources
The wiki component in Moodle through 2.6.11, 2.7.x before 2.7.10, 2.8.x before 2.8.8, and 2.9.x before 2.9.2 does not consider the mod/wiki:managefiles capability before authorizing file management, which allows remote authenticated users to delete arbitrary files by using a manage-files button in a text editor.
— GitHub
Affected Software
Remediation
Recommended actions to resolve this vulnerability, in priority order.
- Upgrade
Upgrade
composer/moodle/moodleto a version that resolves this vulnerability.Fixed in 2.9.2 - Upgrade
Upgrade
composer/moodle/moodleto a version that resolves this vulnerability.Fixed in 2.8.8 - Upgrade
Upgrade
composer/moodle/moodleto a version that resolves this vulnerability.Fixed in 2.7.10
Event History
Frequently Asked Questions
What is the severity of CVE-2015-5265?
CVE-2015-5265 has been classified as a medium severity vulnerability.
How do I fix CVE-2015-5265?
To fix CVE-2015-5265, upgrade Moodle to version 2.7.10, 2.8.8, or 2.9.2 or later.
What are the vulnerable versions associated with CVE-2015-5265?
CVE-2015-5265 affects Moodle versions prior to 2.7.10, 2.8.8, and 2.9.2.
Who can exploit CVE-2015-5265?
CVE-2015-5265 can be exploited by remote authenticated users who possess the manage-files button.
What capabilities are not considered in CVE-2015-5265's vulnerability?
CVE-2015-5265 does not consider the mod/wiki:managefiles capability before authorizing file management.