CVE-2015-3177

Published: Jun 1, 2015Modified: May 6, 2026

3.5

Vector

AV:N/AC:M/Au:S/C:P/I:N/A:N

Exploitability: 6.8 / Impact: 2.9

Source: NVD

Description

Moodle 2.8.x before 2.8.6 does not consider the tool/monitor:subscribe capability before entering subscriptions to site-wide event-monitor rules, which allows remote authenticated users to obtain sensitive information via a subscription request.

Affected (6)

Products: Moodle: Moodle

1 product

Configuration A

6 vulnerable

Vulnerable Software	Affected Versions
Moodle Moodle	Version 2.8.0
Moodle Moodle	Version 2.8.1
Moodle Moodle	Version 2.8.2
Moodle Moodle	Version 2.8.3
Moodle Moodle	Version 2.8.4
Moodle Moodle	Version 2.8.5

Related CWEs

References (10)

http://git.moodle.org/gw?p=moodle.git&a=search&h=HEAD&st=commit&s=MDL-50039

Source: secalert@redhat.com

http://openwall.com/lists/oss-security/2015/05/18/1

Source: secalert@redhat.com

http://www.securityfocus.com/bid/74721

Source: secalert@redhat.com

http://www.securitytracker.com/id/1032358

Source: secalert@redhat.com

https://moodle.org/mod/forum/discuss.php?d=313684

Source: secalert@redhat.com

Vendor Advisory

http://git.moodle.org/gw?p=moodle.git&a=search&h=HEAD&st=commit&s=MDL-50039

Source: af854a3a-2127-422b-91ae-364da2661108

http://openwall.com/lists/oss-security/2015/05/18/1

Source: af854a3a-2127-422b-91ae-364da2661108

http://www.securityfocus.com/bid/74721

Source: af854a3a-2127-422b-91ae-364da2661108

http://www.securitytracker.com/id/1032358

Source: af854a3a-2127-422b-91ae-364da2661108

https://moodle.org/mod/forum/discuss.php?d=313684

Source: af854a3a-2127-422b-91ae-364da2661108

Vendor Advisory

Timeline

No history available yet.