Search for vulnerabilities
Vulnerability details: VCID-du5c-9q66-myc4
Vulnerability ID VCID-du5c-9q66-myc4
Aliases CVE-2015-5268
GHSA-h34c-px28-rjgw
Summary Moodle mishandles group-based authorization checks The rating component in Moodle through 2.6.11, 2.7.x before 2.7.10, 2.8.x before 2.8.8, and 2.9.x before 2.9.2 mishandles group-based authorization checks, which allows remote authenticated users to obtain sensitive information by reading a rating value.
Status Published
Exploitability 0.5
Weighted Severity 6.2
Risk 3.1
Affected and Fixed Packages Package Details
Weaknesses (4)
CWE-1035 OWASP Top Ten 2017 Category A9 - Using Components with Known Vulnerabilities
CWE-200 Exposure of Sensitive Information to an Unauthorized Actor
CWE-264 Permissions, Privileges, and Access Controls
CWE-937 OWASP Top Ten 2013 Category A9 - Using Components with Known Vulnerabilities
System Score Found at
cvssv3.1 4.3 http://git.moodle.org/gw?p=moodle.git&a=search&h=HEAD&st=commit&s=MDL-50173
generic_textual MODERATE http://git.moodle.org/gw?p=moodle.git&a=search&h=HEAD&st=commit&s=MDL-50173
epss 0.00348 https://api.first.org/data/v1/epss?cve=CVE-2015-5268
epss 0.00348 https://api.first.org/data/v1/epss?cve=CVE-2015-5268
cvssv3.1_qr MODERATE https://github.com/advisories/GHSA-h34c-px28-rjgw
cvssv3.1 4.3 https://github.com/moodle/moodle
generic_textual MODERATE https://github.com/moodle/moodle
cvssv3.1 4.3 https://github.com/moodle/moodle/commit/20ff15e22b4f0abebe1ab5fbfd1d681c88765e2a
generic_textual MODERATE https://github.com/moodle/moodle/commit/20ff15e22b4f0abebe1ab5fbfd1d681c88765e2a
cvssv3.1 4.3 https://github.com/moodle/moodle/commit/4015226623111438158fa762b7ce61f6cf677665
generic_textual MODERATE https://github.com/moodle/moodle/commit/4015226623111438158fa762b7ce61f6cf677665
cvssv3.1 4.3 https://github.com/moodle/moodle/commit/731c2712e746053b1ca06b50118632305b447e02
generic_textual MODERATE https://github.com/moodle/moodle/commit/731c2712e746053b1ca06b50118632305b447e02
cvssv3.1 4.3 https://github.com/moodle/moodle/commit/fa57105063129eed83bf09d83348681501ff5b64
generic_textual MODERATE https://github.com/moodle/moodle/commit/fa57105063129eed83bf09d83348681501ff5b64
cvssv3.1 4.3 https://moodle.org/mod/forum/discuss.php?d=320292
generic_textual MODERATE https://moodle.org/mod/forum/discuss.php?d=320292
cvssv3.1 4.3 https://nvd.nist.gov/vuln/detail/CVE-2015-5268
generic_textual MODERATE https://nvd.nist.gov/vuln/detail/CVE-2015-5268
cvssv3.1 4.3 http://www.openwall.com/lists/oss-security/2015/09/21/1
generic_textual MODERATE http://www.openwall.com/lists/oss-security/2015/09/21/1
cvssv3.1 4.3 http://www.securitytracker.com/id/1033619
generic_textual MODERATE http://www.securitytracker.com/id/1033619
Reference id Reference type URL
http://git.moodle.org/gw?p=moodle.git&a=search&h=HEAD&st=commit&s=MDL-50173
https://api.first.org/data/v1/epss?cve=CVE-2015-5268
https://github.com/moodle/moodle
https://github.com/moodle/moodle/commit/20ff15e22b4f0abebe1ab5fbfd1d681c88765e2a
https://github.com/moodle/moodle/commit/4015226623111438158fa762b7ce61f6cf677665
https://github.com/moodle/moodle/commit/731c2712e746053b1ca06b50118632305b447e02
https://github.com/moodle/moodle/commit/fa57105063129eed83bf09d83348681501ff5b64
https://moodle.org/mod/forum/discuss.php?d=320292
https://nvd.nist.gov/vuln/detail/CVE-2015-5268
http://www.openwall.com/lists/oss-security/2015/09/21/1
http://www.securitytracker.com/id/1033619
GHSA-h34c-px28-rjgw https://github.com/advisories/GHSA-h34c-px28-rjgw
No exploits are available.
Vector: CVSS:3.0/AV:N/AC:L/PR:L/UI:N/S:U/C:L/I:N/A:N Found at http://git.moodle.org/gw?p=moodle.git&a=search&h=HEAD&st=commit&s=MDL-50173
Attack Vector (AV) Attack Complexity (AC) Privileges Required (PR) User Interaction (UI) Scope (S) Confidentiality Impact (C) Integrity Impact (I) Availability Impact (A)

network

adjacent_network

local

physical

low

high

none

low

high

none

required

unchanged

changed

high

low

none

high

low

none

high

low

none
Vector: CVSS:3.0/AV:N/AC:L/PR:L/UI:N/S:U/C:L/I:N/A:N Found at https://github.com/moodle/moodle
Attack Vector (AV) Attack Complexity (AC) Privileges Required (PR) User Interaction (UI) Scope (S) Confidentiality Impact (C) Integrity Impact (I) Availability Impact (A)

network

adjacent_network

local

physical

low

high

none

low

high

none

required

unchanged

changed

high

low

none

high

low

none

high

low

none
Vector: CVSS:3.0/AV:N/AC:L/PR:L/UI:N/S:U/C:L/I:N/A:N Found at https://github.com/moodle/moodle/commit/20ff15e22b4f0abebe1ab5fbfd1d681c88765e2a
Attack Vector (AV) Attack Complexity (AC) Privileges Required (PR) User Interaction (UI) Scope (S) Confidentiality Impact (C) Integrity Impact (I) Availability Impact (A)

network

adjacent_network

local

physical

low

high

none

low

high

none

required

unchanged

changed

high

low

none

high

low

none

high

low

none
Vector: CVSS:3.0/AV:N/AC:L/PR:L/UI:N/S:U/C:L/I:N/A:N Found at https://github.com/moodle/moodle/commit/4015226623111438158fa762b7ce61f6cf677665
Attack Vector (AV) Attack Complexity (AC) Privileges Required (PR) User Interaction (UI) Scope (S) Confidentiality Impact (C) Integrity Impact (I) Availability Impact (A)

network

adjacent_network

local

physical

low

high

none

low

high

none

required

unchanged

changed

high

low

none

high

low

none

high

low

none
Vector: CVSS:3.0/AV:N/AC:L/PR:L/UI:N/S:U/C:L/I:N/A:N Found at https://github.com/moodle/moodle/commit/731c2712e746053b1ca06b50118632305b447e02
Attack Vector (AV) Attack Complexity (AC) Privileges Required (PR) User Interaction (UI) Scope (S) Confidentiality Impact (C) Integrity Impact (I) Availability Impact (A)

network

adjacent_network

local

physical

low

high

none

low

high

none

required

unchanged

changed

high

low

none

high

low

none

high

low

none
Vector: CVSS:3.0/AV:N/AC:L/PR:L/UI:N/S:U/C:L/I:N/A:N Found at https://github.com/moodle/moodle/commit/fa57105063129eed83bf09d83348681501ff5b64
Attack Vector (AV) Attack Complexity (AC) Privileges Required (PR) User Interaction (UI) Scope (S) Confidentiality Impact (C) Integrity Impact (I) Availability Impact (A)

network

adjacent_network

local

physical

low

high

none

low

high

none

required

unchanged

changed

high

low

none

high

low

none

high

low

none
Vector: CVSS:3.0/AV:N/AC:L/PR:L/UI:N/S:U/C:L/I:N/A:N Found at https://moodle.org/mod/forum/discuss.php?d=320292
Attack Vector (AV) Attack Complexity (AC) Privileges Required (PR) User Interaction (UI) Scope (S) Confidentiality Impact (C) Integrity Impact (I) Availability Impact (A)

network

adjacent_network

local

physical

low

high

none

low

high

none

required

unchanged

changed

high

low

none

high

low

none

high

low

none
Vector: CVSS:3.0/AV:N/AC:L/PR:L/UI:N/S:U/C:L/I:N/A:N Found at https://nvd.nist.gov/vuln/detail/CVE-2015-5268
Attack Vector (AV) Attack Complexity (AC) Privileges Required (PR) User Interaction (UI) Scope (S) Confidentiality Impact (C) Integrity Impact (I) Availability Impact (A)

network

adjacent_network

local

physical

low

high

none

low

high

none

required

unchanged

changed

high

low

none

high

low

none

high

low

none
Vector: CVSS:3.0/AV:N/AC:L/PR:L/UI:N/S:U/C:L/I:N/A:N Found at http://www.openwall.com/lists/oss-security/2015/09/21/1
Attack Vector (AV) Attack Complexity (AC) Privileges Required (PR) User Interaction (UI) Scope (S) Confidentiality Impact (C) Integrity Impact (I) Availability Impact (A)

network

adjacent_network

local

physical

low

high

none

low

high

none

required

unchanged

changed

high

low

none

high

low

none

high

low

none
Vector: CVSS:3.0/AV:N/AC:L/PR:L/UI:N/S:U/C:L/I:N/A:N Found at http://www.securitytracker.com/id/1033619
Attack Vector (AV) Attack Complexity (AC) Privileges Required (PR) User Interaction (UI) Scope (S) Confidentiality Impact (C) Integrity Impact (I) Availability Impact (A)

network

adjacent_network

local

physical

low

high

none

low

high

none

required

unchanged

changed

high

low

none

high

low

none

high

low

none
Exploit Prediction Scoring System (EPSS)
Percentile 0.56578
EPSS Score 0.00348
Published At June 30, 2025, 12:55 p.m.
Date Actor Action Source VulnerableCode Version
2025-07-01T12:26:16.481187+00:00 GithubOSV Importer Import https://github.com/github/advisory-database/blob/main/advisories/github-reviewed/2022/05/GHSA-h34c-px28-rjgw/GHSA-h34c-px28-rjgw.json 36.1.3