CVE-2015-2271: Moodle - Inadequate Access Restriction

moodle/moodle Updated 02 Oct 2025

Summary

13/05/2022

Disclosed on

CVE-2015-2271

CVE

Yes i

Fix available

Moderate

Severity

Not published

CVSS Score

CVE-2015-2271: Moodle does not consider the moodle/tag:flag capability. Affects moodle/moodle across 3 version ranges.

< 2.6.9 >= 2.7.0, < 2.7.6 >= 2.8.0, < 2.8.4

Fixed in 2.6.9, 2.7.6 or 2.8.4, depending on the release line you run. How to fix ↓

Free scan

Check if this vulnerability affects your application

Upload a manifest or SBOM and we'll show whether you're affected, plus every other risky package in the same scan.

Check my app free

No signup required · Results in about 60 seconds

Upload your dependency manifest or SBOM

Drag & drop your file here or Browse

Java Javascript PHP Python Go Rust Ruby Dart C/C++ Elixir CycloneDX SPDX

Upload a supported dependency manifest or SBOM. No installation or source-code access required.

See supported files and SBOM formats

SBOM sbom.json · bom.json · bom.xml · *.spdx.json · *.cdx.json · *.cdx.xml

Java pom.xml · gradle.lockfile · buildscript-gradle.lockfile

Javascript package-lock.json · yarn.lock · pnpm-lock.yaml

PHP composer.lock

Python poetry.lock · requirements.txt · Pipfile.lock

Go go.mod

Rust Cargo.lock

Ruby Gemfile.lock

Dart pubspec.lock

C/C++ conan.lock

Elixir mix.lock

Enter your work email to receive your report link.

Verify your email to view the full report and start 30 days of continuous monitoring. No credit card required.

Background

Moodle is an open-source learning management system (LMS) used for creating and delivering online courses. It provides a platform for educators to create interactive and collaborative learning environments. Moodle offers various features and capabilities, including the ability to tag content. However, prior to version 2.8.4, Moodle did not properly consider the moodle/tag:flag capability when processing flagging actions. This oversight allowed remote authenticated users to bypass access restrictions through the 'Flag as inappropriate' feature.

Vulnerability Detail

The vulnerability (CVE-2015-2271) in Moodle versions prior to 2.8.4 arises from the lack of consideration for the moodle/tag:flag capability. As a result, remote authenticated users can exploit this flaw to bypass intended access restrictions. By utilizing the 'Flag as inappropriate' feature, these users can perform actions that should have been restricted to them. This vulnerability poses a moderate risk as it can potentially lead to unauthorized access and abuse of the flagging system.

How To Fix

Fixed versions by release line

The minimum fixed version depends on the release line you run.

< 2.6.9 2.6.9
```
composer require moodle/moodle:2.6.9
```
>= 2.7.0, < 2.7.6 2.7.6
```
composer require moodle/moodle:2.7.6
```
>= 2.8.0, < 2.8.4 2.8.4
```
composer require moodle/moodle:2.8.4
```

Tip — Not sure which release line you're on? Vulert can find the fix for the version you are using. Scan free →

Workaround

If upgrading to the latest version is not immediately feasible, a temporary workaround is to disable the 'Flag as inappropriate' feature. This can be done by modifying the Moodle configuration to remove or restrict access to the flagging functionality. However, it is important to note that this workaround only mitigates the vulnerability temporarily and does not provide a permanent solution. Upgrading to the fixed version is still recommended.

Conclusion

In conclusion, the vulnerability (CVE-2015-2271) in Moodle versions prior to 2.8.4 allows remote authenticated users to bypass access restrictions through the 'Flag as inappropriate' feature. Upgrading to Moodle 2.8.4 or later is the recommended solution to address this vulnerability. Alternatively, temporarily disabling the flagging feature can provide a temporary workaround. For further assistance with vulnerability remediation, please contact DevNack.com.

See every vulnerability recorded for moodle/moodle →