Staging Environment: Content and features may be unstable or change without notice.
Advisory details: github_osv / GHSA-v3wp-35g3-m9mm
Advisory ID github_osv/GHSA-v3wp-35g3-m9mm
Aliases CVE-2015-2271
Summary Moodle does not consider the moodle/tag:flag capability tag/user.php in Moodle through 2.5.9, 2.6.x before 2.6.9, 2.7.x before 2.7.6, and 2.8.x before 2.8.4 does not consider the moodle/tag:flag capability before proceeding with a flaginappropriate action, which allows remote authenticated users to bypass intended access restrictions via the "Flag as inappropriate" feature.
Status Published
Exploitability 0.5
Weighted Severity 0.0
Risk
Affected and Fixed Packages Package Details
Introduced and Fixed Package Commit Patches Package Commit Patches Details
Weaknesses (0)
There are no known CWE.
System Score Found at
generic_textual MODERATE
Reference id Reference type URL
http://git.moodle.org/gw?p=moodle.git&a=search&h=HEAD&st=commit&s=MDL-49084
http://openwall.com/lists/oss-security/2015/03/16/1
https://github.com/moodle/moodle
https://github.com/moodle/moodle/commit/1a344ea46f4bdedf6b8c87ae9a419e0617e1ac27
https://github.com/moodle/moodle/commit/64e2179478849ec09c3537716e70ae8a1684b58b
https://github.com/moodle/moodle/commit/8b4e370840dad1ec4ca6c7cef8a4d6b78e0458b7
https://github.com/moodle/moodle/commit/b771b31e20cbf3d39aab877c648cf387e77173ba
https://moodle.org/mod/forum/discuss.php?d=307385
CVE-2015-2271 https://nvd.nist.gov/vuln/detail/CVE-2015-2271
No exploits are available.

No EPSS data available for this advisory.

Patch URL
There are no known patches.
There are no known vectors.

There are no SSVC decisions available.