Search for vulnerabilities
Vulnerability details: VCID-avsr-mhfs-wffw
Vulnerability ID VCID-avsr-mhfs-wffw
Aliases CVE-2015-5339
GHSA-gmhr-6f43-7qpj
Summary Moodle does not properly implement group-based access restrictions The core_enrol_get_enrolled_users web service in enrol/externallib.php in Moodle through 2.6.11, 2.7.x before 2.7.11, 2.8.x before 2.8.9, and 2.9.x before 2.9.3 does not properly implement group-based access restrictions, which allows remote authenticated users to obtain sensitive course-participant information via a web-service request.
Status Published
Exploitability 0.5
Weighted Severity 6.2
Risk 3.1
Affected and Fixed Packages Package Details
Weaknesses (4)
CWE-1035 OWASP Top Ten 2017 Category A9 - Using Components with Known Vulnerabilities
CWE-200 Exposure of Sensitive Information to an Unauthorized Actor
CWE-264 Permissions, Privileges, and Access Controls
CWE-937 OWASP Top Ten 2013 Category A9 - Using Components with Known Vulnerabilities
System Score Found at
cvssv3.1 4.3 http://git.moodle.org/gw?p=moodle.git&a=search&h=HEAD&st=commit&s=MDL-51861
generic_textual MODERATE http://git.moodle.org/gw?p=moodle.git&a=search&h=HEAD&st=commit&s=MDL-51861
epss 0.0027 https://api.first.org/data/v1/epss?cve=CVE-2015-5339
epss 0.0027 https://api.first.org/data/v1/epss?cve=CVE-2015-5339
cvssv3.1_qr MODERATE https://github.com/advisories/GHSA-gmhr-6f43-7qpj
cvssv3.1 4.3 https://github.com/moodle/moodle
generic_textual MODERATE https://github.com/moodle/moodle
cvssv3.1 4.3 https://github.com/moodle/moodle/commit/12bc713081dc24b6eedea54281876e7c3f5579a6
generic_textual MODERATE https://github.com/moodle/moodle/commit/12bc713081dc24b6eedea54281876e7c3f5579a6
cvssv3.1 4.3 https://github.com/moodle/moodle/commit/512633461ae239677342b40d318803e15e1fd1aa
generic_textual MODERATE https://github.com/moodle/moodle/commit/512633461ae239677342b40d318803e15e1fd1aa
cvssv3.1 4.3 https://github.com/moodle/moodle/commit/b26b2407908abb1a8a4d37aebc18e03139c9776f
generic_textual MODERATE https://github.com/moodle/moodle/commit/b26b2407908abb1a8a4d37aebc18e03139c9776f
cvssv3.1 4.3 https://moodle.org/mod/forum/discuss.php?d=323234
generic_textual MODERATE https://moodle.org/mod/forum/discuss.php?d=323234
cvssv3.1 4.3 https://nvd.nist.gov/vuln/detail/CVE-2015-5339
generic_textual MODERATE https://nvd.nist.gov/vuln/detail/CVE-2015-5339
Reference id Reference type URL
http://git.moodle.org/gw?p=moodle.git&a=search&h=HEAD&st=commit&s=MDL-51861
https://api.first.org/data/v1/epss?cve=CVE-2015-5339
https://github.com/moodle/moodle
https://github.com/moodle/moodle/commit/12bc713081dc24b6eedea54281876e7c3f5579a6
https://github.com/moodle/moodle/commit/512633461ae239677342b40d318803e15e1fd1aa
https://github.com/moodle/moodle/commit/b26b2407908abb1a8a4d37aebc18e03139c9776f
https://moodle.org/mod/forum/discuss.php?d=323234
https://nvd.nist.gov/vuln/detail/CVE-2015-5339
GHSA-gmhr-6f43-7qpj https://github.com/advisories/GHSA-gmhr-6f43-7qpj
No exploits are available.
Vector: CVSS:3.0/AV:N/AC:L/PR:L/UI:N/S:U/C:L/I:N/A:N Found at http://git.moodle.org/gw?p=moodle.git&a=search&h=HEAD&st=commit&s=MDL-51861
Attack Vector (AV) Attack Complexity (AC) Privileges Required (PR) User Interaction (UI) Scope (S) Confidentiality Impact (C) Integrity Impact (I) Availability Impact (A)

network

adjacent_network

local

physical

low

high

none

low

high

none

required

unchanged

changed

high

low

none

high

low

none

high

low

none
Vector: CVSS:3.0/AV:N/AC:L/PR:L/UI:N/S:U/C:L/I:N/A:N Found at https://github.com/moodle/moodle
Attack Vector (AV) Attack Complexity (AC) Privileges Required (PR) User Interaction (UI) Scope (S) Confidentiality Impact (C) Integrity Impact (I) Availability Impact (A)

network

adjacent_network

local

physical

low

high

none

low

high

none

required

unchanged

changed

high

low

none

high

low

none

high

low

none
Vector: CVSS:3.0/AV:N/AC:L/PR:L/UI:N/S:U/C:L/I:N/A:N Found at https://github.com/moodle/moodle/commit/12bc713081dc24b6eedea54281876e7c3f5579a6
Attack Vector (AV) Attack Complexity (AC) Privileges Required (PR) User Interaction (UI) Scope (S) Confidentiality Impact (C) Integrity Impact (I) Availability Impact (A)

network

adjacent_network

local

physical

low

high

none

low

high

none

required

unchanged

changed

high

low

none

high

low

none

high

low

none
Vector: CVSS:3.0/AV:N/AC:L/PR:L/UI:N/S:U/C:L/I:N/A:N Found at https://github.com/moodle/moodle/commit/512633461ae239677342b40d318803e15e1fd1aa
Attack Vector (AV) Attack Complexity (AC) Privileges Required (PR) User Interaction (UI) Scope (S) Confidentiality Impact (C) Integrity Impact (I) Availability Impact (A)

network

adjacent_network

local

physical

low

high

none

low

high

none

required

unchanged

changed

high

low

none

high

low

none

high

low

none
Vector: CVSS:3.0/AV:N/AC:L/PR:L/UI:N/S:U/C:L/I:N/A:N Found at https://github.com/moodle/moodle/commit/b26b2407908abb1a8a4d37aebc18e03139c9776f
Attack Vector (AV) Attack Complexity (AC) Privileges Required (PR) User Interaction (UI) Scope (S) Confidentiality Impact (C) Integrity Impact (I) Availability Impact (A)

network

adjacent_network

local

physical

low

high

none

low

high

none

required

unchanged

changed

high

low

none

high

low

none

high

low

none
Vector: CVSS:3.0/AV:N/AC:L/PR:L/UI:N/S:U/C:L/I:N/A:N Found at https://moodle.org/mod/forum/discuss.php?d=323234
Attack Vector (AV) Attack Complexity (AC) Privileges Required (PR) User Interaction (UI) Scope (S) Confidentiality Impact (C) Integrity Impact (I) Availability Impact (A)

network

adjacent_network

local

physical

low

high

none

low

high

none

required

unchanged

changed

high

low

none

high

low

none

high

low

none
Vector: CVSS:3.0/AV:N/AC:L/PR:L/UI:N/S:U/C:L/I:N/A:N Found at https://nvd.nist.gov/vuln/detail/CVE-2015-5339
Attack Vector (AV) Attack Complexity (AC) Privileges Required (PR) User Interaction (UI) Scope (S) Confidentiality Impact (C) Integrity Impact (I) Availability Impact (A)

network

adjacent_network

local

physical

low

high

none

low

high

none

required

unchanged

changed

high

low

none

high

low

none

high

low

none
Exploit Prediction Scoring System (EPSS)
Percentile 0.50234
EPSS Score 0.0027
Published At June 30, 2025, 12:55 p.m.
Date Actor Action Source VulnerableCode Version
2025-07-01T12:27:15.603669+00:00 GithubOSV Importer Import https://github.com/github/advisory-database/blob/main/advisories/github-reviewed/2022/05/GHSA-gmhr-6f43-7qpj/GHSA-gmhr-6f43-7qpj.json 36.1.3