CVE-2015-5266: Moodle allows attackers to obtain manager privileges
Summary
CVE-2015-5266: Moodle allows attackers to obtain manager privileges. Affects moodle/moodle across 3 version ranges.
>= 2.7.0, < 2.7.10
>= 2.8.0, < 2.8.8
>= 2.9.0, < 2.9.2
Fixed in 2.7.10, 2.8.8 or 2.9.2, depending on the release line you run. How to fix ↓
Check if this vulnerability affects your application
Upload a manifest or SBOM and we'll show whether you're affected, plus every other risky package in the same scan.
No signup required · Results in about 60 seconds
Background
Moodle is an open-source learning management system (LMS) used by educational institutions to create online courses and manage learning activities. It provides a platform for teachers and students to interact, share resources, and participate in various educational activities. Moodle is widely adopted and offers a range of features to support online learning. However, a vulnerability has been identified in Moodle versions 2.6.11, 2.7.x before 2.7.10, 2.8.x before 2.8.8, and 2.9.x before 2.9.2 that allows remote authenticated users to obtain manager privileges under specific circumstances.
Vulnerability Detail
The vulnerability, identified as CVE-2015-5266, resides in the enrol_meta_sync function in enrol/meta/locallib.php file. During a long-running sync script, Moodle incorrectly processes roles, leading to the opportunity for remote authenticated users to gain manager privileges. This vulnerability can be exploited by attackers who have authenticated access to the Moodle system. By leveraging this vulnerability, an attacker can elevate their privileges and gain unauthorized access to sensitive information or perform malicious actions within the Moodle environment.
How To Fix
Fixed versions by release line
The minimum fixed version depends on the release line you run.
-
>= 2.7.0, < 2.7.102.7.10composer require moodle/moodle:2.7.10 -
>= 2.8.0, < 2.8.82.8.8composer require moodle/moodle:2.8.8 -
>= 2.9.0, < 2.9.22.9.2composer require moodle/moodle:2.9.2
Tip — Not sure which release line you're on? Vulert can find the fix for the version you are using. Scan free →
Workaround
There is no specific workaround mentioned for this vulnerability. The recommended approach is to upgrade to the fixed versions of Moodle as mentioned in the 'how_to_fix' section.
Conclusion
The identified vulnerability in Moodle versions 2.6.11, 2.7.x before 2.7.10, 2.8.x before 2.8.8, and 2.9.x before 2.9.2 allows remote authenticated users to obtain manager privileges. To mitigate this vulnerability, it is crucial to upgrade to the recommended fixed versions of Moodle. For further support on vulnerability remediation, you can reach out to DevNack.com.
See every vulnerability recorded for moodle/moodle →
FAQ
Moodle is an open-source learning management system used by educational institutions for online course management and learning activities.
This vulnerability allows remote authenticated users to obtain manager privileges in Moodle, potentially leading to unauthorized access to sensitive information or malicious actions within the system.
To fix this vulnerability, it is recommended to upgrade to the fixed versions of Moodle as mentioned in the 'how_to_fix' section.
There are no specific workarounds mentioned for this vulnerability. Upgrading to the fixed versions of Moodle is the recommended approach.
There is no specific information provided about known exploits for this vulnerability. However, it is important to address this vulnerability by upgrading to the fixed versions of Moodle to prevent potential exploitation.
References
Related vulnerabilities
Recent vulnerabilities recorded for moodle/moodle.
