CVE-2015-5264: Moodle - Additional Answer Attempts Vulnerability
Summary
CVE-2015-5264: Moodle allows attackers to enter additional answer attempts. Affects moodle/moodle across 3 version ranges.
>= 2.7.0, < 2.7.10
>= 2.8.0, < 2.8.8
>= 2.9.0, < 2.9.2
Fixed in 2.7.10, 2.8.8 or 2.9.2, depending on the release line you run. How to fix ↓
Check if this vulnerability affects your application
Upload a manifest or SBOM and we'll show whether you're affected, plus every other risky package in the same scan.
No signup required · Results in about 60 seconds
Background
Moodle is an open-source learning management system (LMS) used by educational institutions to create and deliver online courses. It provides a platform for educators to create interactive lessons and assessments for students. The lesson module in Moodle versions 2.6.11, 2.7.x before 2.7.10, 2.8.x before 2.8.8, and 2.9.x before 2.9.2 is susceptible to a vulnerability that allows remote authenticated users to bypass access restrictions and enter additional answer attempts. This vulnerability affects the student role in Moodle.
Vulnerability Detail
The vulnerability in Moodle's lesson module allows authenticated users with the student role to bypass intended access restrictions and enter additional answer attempts. This can lead to unauthorized access to lesson content and potentially compromise the integrity of assessments. Attackers can exploit this vulnerability by leveraging the student role to gain unauthorized access to additional answer attempts, potentially affecting the fairness and accuracy of assessments.
How To Fix
Fixed versions by release line
The minimum fixed version depends on the release line you run.
-
>= 2.7.0, < 2.7.102.7.10composer require moodle/moodle:2.7.10 -
>= 2.8.0, < 2.8.82.8.8composer require moodle/moodle:2.8.8 -
>= 2.9.0, < 2.9.22.9.2composer require moodle/moodle:2.9.2
Tip — Not sure which release line you're on? Vulert can find the fix for the version you are using. Scan free →
Workaround
There is no known workaround for this vulnerability. It is recommended to apply the necessary updates or patches provided by Moodle to mitigate the risk.
Conclusion
The vulnerability in Moodle's lesson module allows authenticated users with the student role to bypass access restrictions and enter additional answer attempts. To mitigate this risk, it is crucial to upgrade to the fixed versions of Moodle or apply the necessary updates. For further support on vulnerability remediation, please contact DevNack.com.
See every vulnerability recorded for moodle/moodle →
FAQ
Moodle is an open-source learning management system (LMS) used by educational institutions to create and deliver online courses.
The vulnerability affects Moodle versions 2.6.11, 2.7.x before 2.7.10, 2.8.x before 2.8.8, and 2.9.x before 2.9.2.
The vulnerability allows authenticated users with the student role to bypass access restrictions and enter additional answer attempts, potentially compromising the integrity of assessments.
To fix this vulnerability, it is recommended to upgrade to the latest version of Moodle. For affected versions, the fixed versions are 2.7.10, 2.8.8, and 2.9.2.
There is no known workaround for this vulnerability. It is recommended to apply the necessary updates or patches provided by Moodle.
References
Related vulnerabilities
Recent vulnerabilities recorded for moodle/moodle.
