medium4.3
CVE-2015-5272
The Forum module in Moodle 2.7.x before 2.7.10 allows remote authenticated users to post to arbitrary groups by leveraging the teacher role, as demonstrated by…
Impact
The Forum module in Moodle 2.7.x before 2.7.10 allows remote authenticated users to post to arbitrary groups by leveraging the teacher role, as demonstrated by a post directed to "all participants."
Affected products
| Vendor | Product | Affected versions |
|---|---|---|
| Moodle | Moodle | Versions 2.7.0, 2.7.1, 2.7.2, 2.7.3, 2.7.4, 2.7.5 |
Weakness classification
References
- NVD record
- CVE.org record
- http://git.moodle.org/gw?p=moodle.git&a=search&h=HEAD&st=commit&s=MDL-50576
- http://www.openwall.com/lists/oss-security/2015/09/21/1
- http://www.securitytracker.com/id/1033619
- https://moodle.org/mod/forum/discuss.php?d=320288
- http://git.moodle.org/gw?p=moodle.git&a=search&h=HEAD&st=commit&s=MDL-50576
- http://www.openwall.com/lists/oss-security/2015/09/21/1
- http://www.securitytracker.com/id/1033619
- https://moodle.org/mod/forum/discuss.php?d=320288