CVE-2015-5342

Published: Feb 22, 2016Modified: May 6, 2026

4.3

Vector

CVSS:3.0/AV:N/AC:L/PR:L/UI:N/S:U/C:N/I:L/A:N

Exploitability: 2.8 / Impact: 1.4

Source: NVD

Description

The choice module in Moodle through 2.6.11, 2.7.x before 2.7.11, 2.8.x before 2.8.9, and 2.9.x before 2.9.3 allows remote authenticated users to bypass intended access restrictions by visiting a URL to add or delete responses in the closed state.

Affected (24)

Products: Moodle: Moodle

Moodle

1 product

Moodle

Configuration A

24 vulnerable

Vulnerable Software	Affected Versions
Moodle Moodle	Up to 2.6.11
Moodle Moodle	Version 2.7.0
Moodle Moodle	Version 2.7.10
Moodle Moodle	Version 2.7.1
Moodle Moodle	Version 2.7.2
Moodle Moodle	Version 2.7.3
Moodle Moodle	Version 2.7.4
Moodle Moodle	Version 2.7.5
Moodle Moodle	Version 2.7.6
Moodle Moodle	Version 2.7.7
Moodle Moodle	Version 2.7.8
Moodle Moodle	Version 2.7.9
Moodle Moodle	Version 2.8.0
Moodle Moodle	Version 2.8.1
Moodle Moodle	Version 2.8.2
Moodle Moodle	Version 2.8.3
Moodle Moodle	Version 2.8.4
Moodle Moodle	Version 2.8.5
Moodle Moodle	Version 2.8.6
Moodle Moodle	Version 2.8.7
Moodle Moodle	Version 2.8.8
Moodle Moodle	Version 2.9.0
Moodle Moodle	Version 2.9.1
Moodle Moodle	Version 2.9.2

Related CWEs

CWE-264

References (4)

http://git.moodle.org/gw?p=moodle.git&a=search&h=HEAD&st=commit&s=MDL-51569

Source: secalert@redhat.com

https://moodle.org/mod/forum/discuss.php?d=323237

Source: secalert@redhat.com

Vendor Advisory

http://git.moodle.org/gw?p=moodle.git&a=search&h=HEAD&st=commit&s=MDL-51569

Source: af854a3a-2127-422b-91ae-364da2661108

https://moodle.org/mod/forum/discuss.php?d=323237

Source: af854a3a-2127-422b-91ae-364da2661108

Vendor Advisory

Timeline

No history available yet.