CVE-2015-0217: Denial of Service Vulnerability in Moodle
Summary
CVE-2015-0217: Moodle allows attackers to cause a denial of service. Affects moodle/moodle across 3 version ranges.
< 2.6.7
>= 2.7.0, < 2.7.4
>= 2.8.0, < 2.8.2
Fixed in 2.6.7, 2.7.4 or 2.8.2, depending on the release line you run. How to fix ↓
Check if this vulnerability affects your application
Upload a manifest or SBOM and we'll show whether you're affected, plus every other risky package in the same scan.
No signup required · Results in about 60 seconds
Background
Moodle is an open-source learning management system (LMS) widely used for creating and delivering online courses. It provides a platform for educators to create interactive learning environments and engage with students. Moodle is written in PHP and offers various features such as course management, assessments, forums, and multimedia support.
Vulnerability Detail
The vulnerability identified as CVE-2015-0217 affects Moodle versions prior to 2.6.7, 2.7.4, and 2.8.2. It resides in the 'filter/mediaplugin/filter.php' file and can be exploited by remote authenticated users. By submitting a specially crafted string that matches an improper regular expression, an attacker can cause a denial of service (DoS) condition. This can result in excessive CPU consumption or partial outage, impacting the availability and performance of the Moodle instance.
How To Fix
Fixed versions by release line
The minimum fixed version depends on the release line you run.
-
< 2.6.72.6.7composer require moodle/moodle:2.6.7 -
>= 2.7.0, < 2.7.42.7.4composer require moodle/moodle:2.7.4 -
>= 2.8.0, < 2.8.22.8.2composer require moodle/moodle:2.8.2
Tip — Not sure which release line you're on? Vulert can find the fix for the version you are using. Scan free →
Workaround
There is no specific workaround provided for this vulnerability. However, applying the recommended fix by upgrading to the patched versions is the best course of action.
Conclusion
The CVE-2015-0217 vulnerability in Moodle allows authenticated users to cause a denial of service (DoS) condition. Upgrading to the patched versions is crucial to mitigate the risk of exploitation. For further assistance and support in vulnerability remediation, please reach out to DevNack.com.
See every vulnerability recorded for moodle/moodle →
FAQ
Moodle is an open-source learning management system (LMS) used for creating and delivering online courses.
The vulnerability allows authenticated users to cause a denial of service (DoS) condition, leading to CPU consumption or partial outage of the Moodle instance.
To fix the vulnerability, upgrade Moodle to version 2.6.7, 2.7.4, or 2.8.2, depending on the installed version.
No specific workaround is provided. It is recommended to apply the fix by upgrading to the patched versions.
For more information, you can refer to the CVE-2015-0217 advisory or contact the Moodle support team.
References
Related vulnerabilities
Recent vulnerabilities recorded for moodle/moodle.
