GHSA-454r-4cjv-vc9h
Suggest an improvement- Source
- https://github.com/advisories/GHSA-454r-4cjv-vc9h
- Import Source
- https://github.com/github/advisory-database/blob/main/advisories/github-reviewed/2022/05/GHSA-454r-4cjv-vc9h/GHSA-454r-4cjv-vc9h.json
- JSON Data
- https://api.osv.dev/v1/vulns/GHSA-454r-4cjv-vc9h
- Aliases
-
- CVE-2015-5266
- Published
- 2022-05-13T01:12:47Z
- Modified
- 2024-12-08T05:30:23.458825Z
- Severity
-
- 6.8 (Medium) CVSS_V3 - CVSS:3.0/AV:N/AC:H/PR:L/UI:N/S:U/C:H/I:H/A:N CVSS Calculator
- Summary
- Moodle allows attackers to obtain manager privileges
- Details
-
The enrolmetasync function in enrol/meta/locallib.php in Moodle through 2.6.11, 2.7.x before 2.7.10, 2.8.x before 2.8.8, and 2.9.x before 2.9.2 allows remote authenticated users to obtain manager privileges in opportunistic circumstances by leveraging incorrect role processing during a long-running sync script.
- Database specific
{ "nvd_published_at": "2016-02-22T05:59:00Z", "cwe_ids": [], "severity": "MODERATE", "github_reviewed": true, "github_reviewed_at": "2024-01-26T01:55:04Z" }- References
-
- https://nvd.nist.gov/vuln/detail/CVE-2015-5266
- https://github.com/moodle/moodle/commit/936facab28d8d8bd03f38da42cb80fafba1a06db
- https://github.com/moodle/moodle/commit/ab006d43e48add8e5495141d4d750c1531772ca2
- https://github.com/moodle/moodle/commit/dff6cdc88355f22ebaaf8f00c44a1ad51d272344
- https://github.com/moodle/moodle/commit/f7fbc80766b72ed1c9915698edd443ee8f6eafbd
- https://github.com/moodle/moodle
- https://moodle.org/mod/forum/discuss.php?d=320290
- https://web.archive.org/web/20160323063809/http://www.securitytracker.com/id/1033619
- http://git.moodle.org/gw?p=moodle.git&a=search&h=HEAD&st=commit&s=MDL-50744
- http://www.openwall.com/lists/oss-security/2015/09/21/1
Affected packages
Packagist / moodle/moodle
Package
- Name
- moodle/moodle
- Purl
- pkg:composer/moodle/moodle
Packagist / moodle/moodle
Package
- Name
- moodle/moodle
- Purl
- pkg:composer/moodle/moodle
Packagist / moodle/moodle
Package
- Name
- moodle/moodle
- Purl
- pkg:composer/moodle/moodle