CVE-2015-5335: Infoleak
Cross-site request forgery (CSRF) vulnerability in admin/registration/register.php in Moodle through 2.6.11, 2.7.x before 2.7.11, 2.8.x before 2.8.9, and 2.9.x before 2.9.3 allows remote attackers to hijack the authentication of administrators for requests that send statistics to an arbitrary hub URL.
Affected Software
Event History
Frequently Asked Questions
What is the severity of CVE-2015-5335?
CVE-2015-5335 is classified as a medium severity vulnerability due to its ability to allow CSRF attacks against administrators.
How do I fix CVE-2015-5335?
To fix CVE-2015-5335, upgrade Moodle to version 2.7.11, 2.8.9, or 2.9.3 or later.
What types of attacks are possible with CVE-2015-5335?
CVE-2015-5335 allows attackers to hijack administrator authentication for sending statistics to arbitrary hubs.
Which versions of Moodle are affected by CVE-2015-5335?
CVE-2015-5335 affects Moodle versions 2.6.11 and earlier, as well as 2.7.x before 2.7.11, 2.8.x before 2.8.9, and 2.9.x before 2.9.3.
Is CVE-2015-5335 a cross-site scripting vulnerability?
No, CVE-2015-5335 is a cross-site request forgery (CSRF) vulnerability, not a cross-site scripting (XSS) vulnerability.