CVE-2015-5342: Moodle allows attackers to bypass intended access restrictions
Moodle allows attackers to bypass intended access restrictions
Other sources
The choice module in Moodle through 2.6.11, 2.7.x before 2.7.11, 2.8.x before 2.8.9, and 2.9.x before 2.9.3 allows remote authenticated users to bypass intended access restrictions by visiting a URL to add or delete responses in the closed state.
— GitHub
Affected Software
Remediation
Recommended actions to resolve this vulnerability, in priority order.
- Upgrade
Upgrade
composer/moodle/moodleto a version that resolves this vulnerability.Fixed in 2.9.3 - Upgrade
Upgrade
composer/moodle/moodleto a version that resolves this vulnerability.Fixed in 2.8.9 - Upgrade
Upgrade
composer/moodle/moodleto a version that resolves this vulnerability.Fixed in 2.7.11 - Upgrade
Upgrade
Moodle choice moduleto a version that resolves this vulnerability.Fixed in 2.7.11 - Upgrade
Upgrade
Moodle choice moduleto a version that resolves this vulnerability.Fixed in 2.8.9 - Upgrade
Upgrade
Moodle choice moduleto a version that resolves this vulnerability.Fixed in 2.9.3
Event History
Frequently Asked Questions
What is the severity of CVE-2015-5342?
CVE-2015-5342 is classified as a medium severity vulnerability.
How do I fix CVE-2015-5342?
To fix CVE-2015-5342, update your Moodle installation to versions 2.7.11, 2.8.9, or 2.9.3 and above.
What types of access restrictions are bypassed by CVE-2015-5342?
CVE-2015-5342 allows remote authenticated users to bypass access restrictions to add or delete responses in the closed state.
Which versions of Moodle are affected by CVE-2015-5342?
CVE-2015-5342 affects Moodle versions through 2.6.11, 2.7.x before 2.7.11, 2.8.x before 2.8.9, and 2.9.x before 2.9.3.
What module in Moodle is vulnerable to CVE-2015-5342?
The choice module in Moodle is vulnerable to CVE-2015-5342.