CVE-2015-5331

Published: Feb 22, 2016Modified: May 6, 2026

4.3

Vector

CVSS:3.0/AV:N/AC:L/PR:L/UI:N/S:U/C:N/I:L/A:N

Exploitability: 2.8 / Impact: 1.4

Source: NVD

Description

Moodle 2.9.x before 2.9.3 does not properly check the contact list before authorizing message transmission, which allows remote authenticated users to bypass intended access restrictions and conduct spam attacks via the messaging API.

Affected (3)

Products: Moodle: Moodle

Moodle

1 product

Moodle

Configuration A

3 vulnerable

Vulnerable Software	Affected Versions
Moodle Moodle	Version 2.9.0
Moodle Moodle	Version 2.9.1
Moodle Moodle	Version 2.9.2

Related CWEs

CWE-254

References (4)

http://git.moodle.org/gw?p=moodle.git&a=search&h=HEAD&st=commit&s=MDL-50426

Source: secalert@redhat.com

https://moodle.org/mod/forum/discuss.php?d=323228

Source: secalert@redhat.com

Vendor Advisory

http://git.moodle.org/gw?p=moodle.git&a=search&h=HEAD&st=commit&s=MDL-50426

Source: af854a3a-2127-422b-91ae-364da2661108

https://moodle.org/mod/forum/discuss.php?d=323228

Source: af854a3a-2127-422b-91ae-364da2661108

Vendor Advisory

Timeline

No history available yet.