Search for vulnerabilities
Vulnerability details: VCID-mq6w-vqwf-t7ea
Vulnerability ID VCID-mq6w-vqwf-t7ea
Aliases CVE-2015-5266
GHSA-454r-4cjv-vc9h
Summary Moodle allows attackers to obtain manager privileges The enrol_meta_sync function in enrol/meta/locallib.php in Moodle through 2.6.11, 2.7.x before 2.7.10, 2.8.x before 2.8.8, and 2.9.x before 2.9.2 allows remote authenticated users to obtain manager privileges in opportunistic circumstances by leveraging incorrect role processing during a long-running sync script.
Status Published
Exploitability 0.5
Weighted Severity 6.2
Risk 3.1
Affected and Fixed Packages Package Details
Weaknesses (3)
CWE-1035 OWASP Top Ten 2017 Category A9 - Using Components with Known Vulnerabilities
CWE-264 Permissions, Privileges, and Access Controls
CWE-937 OWASP Top Ten 2013 Category A9 - Using Components with Known Vulnerabilities
System Score Found at
cvssv3.1 6.8 http://git.moodle.org/gw?p=moodle.git&a=search&h=HEAD&st=commit&s=MDL-50744
generic_textual MODERATE http://git.moodle.org/gw?p=moodle.git&a=search&h=HEAD&st=commit&s=MDL-50744
epss 0.00298 https://api.first.org/data/v1/epss?cve=CVE-2015-5266
epss 0.00298 https://api.first.org/data/v1/epss?cve=CVE-2015-5266
cvssv3.1_qr MODERATE https://github.com/advisories/GHSA-454r-4cjv-vc9h
cvssv3.1 6.8 https://github.com/moodle/moodle
generic_textual MODERATE https://github.com/moodle/moodle
cvssv3.1 6.8 https://github.com/moodle/moodle/commit/936facab28d8d8bd03f38da42cb80fafba1a06db
generic_textual MODERATE https://github.com/moodle/moodle/commit/936facab28d8d8bd03f38da42cb80fafba1a06db
cvssv3.1 6.8 https://github.com/moodle/moodle/commit/ab006d43e48add8e5495141d4d750c1531772ca2
generic_textual MODERATE https://github.com/moodle/moodle/commit/ab006d43e48add8e5495141d4d750c1531772ca2
cvssv3.1 6.8 https://github.com/moodle/moodle/commit/dff6cdc88355f22ebaaf8f00c44a1ad51d272344
generic_textual MODERATE https://github.com/moodle/moodle/commit/dff6cdc88355f22ebaaf8f00c44a1ad51d272344
cvssv3.1 6.8 https://github.com/moodle/moodle/commit/f7fbc80766b72ed1c9915698edd443ee8f6eafbd
generic_textual MODERATE https://github.com/moodle/moodle/commit/f7fbc80766b72ed1c9915698edd443ee8f6eafbd
cvssv3.1 6.8 https://moodle.org/mod/forum/discuss.php?d=320290
generic_textual MODERATE https://moodle.org/mod/forum/discuss.php?d=320290
cvssv3.1 6.8 https://nvd.nist.gov/vuln/detail/CVE-2015-5266
generic_textual MODERATE https://nvd.nist.gov/vuln/detail/CVE-2015-5266
cvssv3.1 6.8 https://web.archive.org/web/20160323063809/http://www.securitytracker.com/id/1033619
generic_textual MODERATE https://web.archive.org/web/20160323063809/http://www.securitytracker.com/id/1033619
cvssv3.1 6.8 http://www.openwall.com/lists/oss-security/2015/09/21/1
generic_textual MODERATE http://www.openwall.com/lists/oss-security/2015/09/21/1
Reference id Reference type URL
http://git.moodle.org/gw?p=moodle.git&a=search&h=HEAD&st=commit&s=MDL-50744
https://api.first.org/data/v1/epss?cve=CVE-2015-5266
https://github.com/moodle/moodle
https://github.com/moodle/moodle/commit/936facab28d8d8bd03f38da42cb80fafba1a06db
https://github.com/moodle/moodle/commit/ab006d43e48add8e5495141d4d750c1531772ca2
https://github.com/moodle/moodle/commit/dff6cdc88355f22ebaaf8f00c44a1ad51d272344
https://github.com/moodle/moodle/commit/f7fbc80766b72ed1c9915698edd443ee8f6eafbd
https://moodle.org/mod/forum/discuss.php?d=320290
https://nvd.nist.gov/vuln/detail/CVE-2015-5266
https://web.archive.org/web/20160323063809/http://www.securitytracker.com/id/1033619
http://www.openwall.com/lists/oss-security/2015/09/21/1
GHSA-454r-4cjv-vc9h https://github.com/advisories/GHSA-454r-4cjv-vc9h
No exploits are available.
Vector: CVSS:3.0/AV:N/AC:H/PR:L/UI:N/S:U/C:H/I:H/A:N Found at http://git.moodle.org/gw?p=moodle.git&a=search&h=HEAD&st=commit&s=MDL-50744
Attack Vector (AV) Attack Complexity (AC) Privileges Required (PR) User Interaction (UI) Scope (S) Confidentiality Impact (C) Integrity Impact (I) Availability Impact (A)

network

adjacent_network

local

physical

low

high

none

low

high

none

required

unchanged

changed

high

low

none

high

low

none

high

low

none
Vector: CVSS:3.0/AV:N/AC:H/PR:L/UI:N/S:U/C:H/I:H/A:N Found at https://github.com/moodle/moodle
Attack Vector (AV) Attack Complexity (AC) Privileges Required (PR) User Interaction (UI) Scope (S) Confidentiality Impact (C) Integrity Impact (I) Availability Impact (A)

network

adjacent_network

local

physical

low

high

none

low

high

none

required

unchanged

changed

high

low

none

high

low

none

high

low

none
Vector: CVSS:3.0/AV:N/AC:H/PR:L/UI:N/S:U/C:H/I:H/A:N Found at https://github.com/moodle/moodle/commit/936facab28d8d8bd03f38da42cb80fafba1a06db
Attack Vector (AV) Attack Complexity (AC) Privileges Required (PR) User Interaction (UI) Scope (S) Confidentiality Impact (C) Integrity Impact (I) Availability Impact (A)

network

adjacent_network

local

physical

low

high

none

low

high

none

required

unchanged

changed

high

low

none

high

low

none

high

low

none
Vector: CVSS:3.0/AV:N/AC:H/PR:L/UI:N/S:U/C:H/I:H/A:N Found at https://github.com/moodle/moodle/commit/ab006d43e48add8e5495141d4d750c1531772ca2
Attack Vector (AV) Attack Complexity (AC) Privileges Required (PR) User Interaction (UI) Scope (S) Confidentiality Impact (C) Integrity Impact (I) Availability Impact (A)

network

adjacent_network

local

physical

low

high

none

low

high

none

required

unchanged

changed

high

low

none

high

low

none

high

low

none
Vector: CVSS:3.0/AV:N/AC:H/PR:L/UI:N/S:U/C:H/I:H/A:N Found at https://github.com/moodle/moodle/commit/dff6cdc88355f22ebaaf8f00c44a1ad51d272344
Attack Vector (AV) Attack Complexity (AC) Privileges Required (PR) User Interaction (UI) Scope (S) Confidentiality Impact (C) Integrity Impact (I) Availability Impact (A)

network

adjacent_network

local

physical

low

high

none

low

high

none

required

unchanged

changed

high

low

none

high

low

none

high

low

none
Vector: CVSS:3.0/AV:N/AC:H/PR:L/UI:N/S:U/C:H/I:H/A:N Found at https://github.com/moodle/moodle/commit/f7fbc80766b72ed1c9915698edd443ee8f6eafbd
Attack Vector (AV) Attack Complexity (AC) Privileges Required (PR) User Interaction (UI) Scope (S) Confidentiality Impact (C) Integrity Impact (I) Availability Impact (A)

network

adjacent_network

local

physical

low

high

none

low

high

none

required

unchanged

changed

high

low

none

high

low

none

high

low

none
Vector: CVSS:3.0/AV:N/AC:H/PR:L/UI:N/S:U/C:H/I:H/A:N Found at https://moodle.org/mod/forum/discuss.php?d=320290
Attack Vector (AV) Attack Complexity (AC) Privileges Required (PR) User Interaction (UI) Scope (S) Confidentiality Impact (C) Integrity Impact (I) Availability Impact (A)

network

adjacent_network

local

physical

low

high

none

low

high

none

required

unchanged

changed

high

low

none

high

low

none

high

low

none
Vector: CVSS:3.0/AV:N/AC:H/PR:L/UI:N/S:U/C:H/I:H/A:N Found at https://nvd.nist.gov/vuln/detail/CVE-2015-5266
Attack Vector (AV) Attack Complexity (AC) Privileges Required (PR) User Interaction (UI) Scope (S) Confidentiality Impact (C) Integrity Impact (I) Availability Impact (A)

network

adjacent_network

local

physical

low

high

none

low

high

none

required

unchanged

changed

high

low

none

high

low

none

high

low

none
Vector: CVSS:3.0/AV:N/AC:H/PR:L/UI:N/S:U/C:H/I:H/A:N Found at https://web.archive.org/web/20160323063809/http://www.securitytracker.com/id/1033619
Attack Vector (AV) Attack Complexity (AC) Privileges Required (PR) User Interaction (UI) Scope (S) Confidentiality Impact (C) Integrity Impact (I) Availability Impact (A)

network

adjacent_network

local

physical

low

high

none

low

high

none

required

unchanged

changed

high

low

none

high

low

none

high

low

none
Vector: CVSS:3.0/AV:N/AC:H/PR:L/UI:N/S:U/C:H/I:H/A:N Found at http://www.openwall.com/lists/oss-security/2015/09/21/1
Attack Vector (AV) Attack Complexity (AC) Privileges Required (PR) User Interaction (UI) Scope (S) Confidentiality Impact (C) Integrity Impact (I) Availability Impact (A)

network

adjacent_network

local

physical

low

high

none

low

high

none

required

unchanged

changed

high

low

none

high

low

none

high

low

none
Exploit Prediction Scoring System (EPSS)
Percentile 0.52711
EPSS Score 0.00298
Published At June 30, 2025, 12:55 p.m.
Date Actor Action Source VulnerableCode Version
2025-07-01T12:29:51.149804+00:00 GithubOSV Importer Import https://github.com/github/advisory-database/blob/main/advisories/github-reviewed/2022/05/GHSA-454r-4cjv-vc9h/GHSA-454r-4cjv-vc9h.json 36.1.3