Search for vulnerabilities
Vulnerability details: VCID-rd28-mcq6-h3hj
Vulnerability ID VCID-rd28-mcq6-h3hj
Aliases CVE-2015-5267
GHSA-382v-gxj9-ffhc
Summary Moodle uses predictable password-recovery tokens lib/moodlelib.php in Moodle through 2.6.11, 2.7.x before 2.7.10, 2.8.x before 2.8.8, and 2.9.x before 2.9.2 relies on the PHP mt_rand function to implement the random_string and complex_random_string functions, which makes it easier for remote attackers to predict password-recovery tokens via a brute-force approach.
Status Published
Exploitability 0.5
Weighted Severity 8.0
Risk 4.0
Affected and Fixed Packages Package Details
Weaknesses (4)
CWE-200 Exposure of Sensitive Information to an Unauthorized Actor
CWE-1035 OWASP Top Ten 2017 Category A9 - Using Components with Known Vulnerabilities
CWE-254 7PK - Security Features
CWE-937 OWASP Top Ten 2013 Category A9 - Using Components with Known Vulnerabilities
System Score Found at
cvssv3.1 7.5 http://git.moodle.org/gw?p=moodle.git&a=search&h=HEAD&st=commit&s=MDL-50860
generic_textual HIGH http://git.moodle.org/gw?p=moodle.git&a=search&h=HEAD&st=commit&s=MDL-50860
epss 0.00537 https://api.first.org/data/v1/epss?cve=CVE-2015-5267
epss 0.00537 https://api.first.org/data/v1/epss?cve=CVE-2015-5267
cvssv3.1_qr HIGH https://github.com/advisories/GHSA-382v-gxj9-ffhc
cvssv3.1 7.5 https://github.com/moodle/moodle
generic_textual HIGH https://github.com/moodle/moodle
cvssv3.1 7.5 https://github.com/moodle/moodle/commit/289bc7f9e3022918b4cfd2cc9851472f0cea2896
generic_textual HIGH https://github.com/moodle/moodle/commit/289bc7f9e3022918b4cfd2cc9851472f0cea2896
cvssv3.1 7.5 https://github.com/moodle/moodle/commit/5337b2295237958c93b6c65fa595859aaa7bf257
generic_textual HIGH https://github.com/moodle/moodle/commit/5337b2295237958c93b6c65fa595859aaa7bf257
cvssv3.1 7.5 https://github.com/moodle/moodle/commit/6e8224365ffcdf328458ea7852dc62574e806119
generic_textual HIGH https://github.com/moodle/moodle/commit/6e8224365ffcdf328458ea7852dc62574e806119
cvssv3.1 7.5 https://github.com/moodle/moodle/commit/e4ac3879c2d1f8fe66caa74ff1544248bccef61e
generic_textual HIGH https://github.com/moodle/moodle/commit/e4ac3879c2d1f8fe66caa74ff1544248bccef61e
cvssv3.1 7.5 https://moodle.org/mod/forum/discuss.php?d=320291
generic_textual HIGH https://moodle.org/mod/forum/discuss.php?d=320291
cvssv3.1 7.5 https://nvd.nist.gov/vuln/detail/CVE-2015-5267
generic_textual HIGH https://nvd.nist.gov/vuln/detail/CVE-2015-5267
cvssv3.1 7.5 https://web.archive.org/web/20160323063809/http://www.securitytracker.com/id/1033619
generic_textual HIGH https://web.archive.org/web/20160323063809/http://www.securitytracker.com/id/1033619
cvssv3.1 7.5 http://www.openwall.com/lists/oss-security/2015/09/21/1
generic_textual HIGH http://www.openwall.com/lists/oss-security/2015/09/21/1
Reference id Reference type URL
http://git.moodle.org/gw?p=moodle.git&a=search&h=HEAD&st=commit&s=MDL-50860
https://api.first.org/data/v1/epss?cve=CVE-2015-5267
https://github.com/moodle/moodle
https://github.com/moodle/moodle/commit/289bc7f9e3022918b4cfd2cc9851472f0cea2896
https://github.com/moodle/moodle/commit/5337b2295237958c93b6c65fa595859aaa7bf257
https://github.com/moodle/moodle/commit/6e8224365ffcdf328458ea7852dc62574e806119
https://github.com/moodle/moodle/commit/e4ac3879c2d1f8fe66caa74ff1544248bccef61e
https://moodle.org/mod/forum/discuss.php?d=320291
https://nvd.nist.gov/vuln/detail/CVE-2015-5267
https://web.archive.org/web/20160323063809/http://www.securitytracker.com/id/1033619
http://www.openwall.com/lists/oss-security/2015/09/21/1
GHSA-382v-gxj9-ffhc https://github.com/advisories/GHSA-382v-gxj9-ffhc
No exploits are available.
Vector: CVSS:3.0/AV:N/AC:L/PR:N/UI:N/S:U/C:H/I:N/A:N Found at http://git.moodle.org/gw?p=moodle.git&a=search&h=HEAD&st=commit&s=MDL-50860
Attack Vector (AV) Attack Complexity (AC) Privileges Required (PR) User Interaction (UI) Scope (S) Confidentiality Impact (C) Integrity Impact (I) Availability Impact (A)

network

adjacent_network

local

physical

low

high

none

low

high

none

required

unchanged

changed

high

low

none

high

low

none

high

low

none
Vector: CVSS:3.0/AV:N/AC:L/PR:N/UI:N/S:U/C:H/I:N/A:N Found at https://github.com/moodle/moodle
Attack Vector (AV) Attack Complexity (AC) Privileges Required (PR) User Interaction (UI) Scope (S) Confidentiality Impact (C) Integrity Impact (I) Availability Impact (A)

network

adjacent_network

local

physical

low

high

none

low

high

none

required

unchanged

changed

high

low

none

high

low

none

high

low

none
Vector: CVSS:3.0/AV:N/AC:L/PR:N/UI:N/S:U/C:H/I:N/A:N Found at https://github.com/moodle/moodle/commit/289bc7f9e3022918b4cfd2cc9851472f0cea2896
Attack Vector (AV) Attack Complexity (AC) Privileges Required (PR) User Interaction (UI) Scope (S) Confidentiality Impact (C) Integrity Impact (I) Availability Impact (A)

network

adjacent_network

local

physical

low

high

none

low

high

none

required

unchanged

changed

high

low

none

high

low

none

high

low

none
Vector: CVSS:3.0/AV:N/AC:L/PR:N/UI:N/S:U/C:H/I:N/A:N Found at https://github.com/moodle/moodle/commit/5337b2295237958c93b6c65fa595859aaa7bf257
Attack Vector (AV) Attack Complexity (AC) Privileges Required (PR) User Interaction (UI) Scope (S) Confidentiality Impact (C) Integrity Impact (I) Availability Impact (A)

network

adjacent_network

local

physical

low

high

none

low

high

none

required

unchanged

changed

high

low

none

high

low

none

high

low

none
Vector: CVSS:3.0/AV:N/AC:L/PR:N/UI:N/S:U/C:H/I:N/A:N Found at https://github.com/moodle/moodle/commit/6e8224365ffcdf328458ea7852dc62574e806119
Attack Vector (AV) Attack Complexity (AC) Privileges Required (PR) User Interaction (UI) Scope (S) Confidentiality Impact (C) Integrity Impact (I) Availability Impact (A)

network

adjacent_network

local

physical

low

high

none

low

high

none

required

unchanged

changed

high

low

none

high

low

none

high

low

none
Vector: CVSS:3.0/AV:N/AC:L/PR:N/UI:N/S:U/C:H/I:N/A:N Found at https://github.com/moodle/moodle/commit/e4ac3879c2d1f8fe66caa74ff1544248bccef61e
Attack Vector (AV) Attack Complexity (AC) Privileges Required (PR) User Interaction (UI) Scope (S) Confidentiality Impact (C) Integrity Impact (I) Availability Impact (A)

network

adjacent_network

local

physical

low

high

none

low

high

none

required

unchanged

changed

high

low

none

high

low

none

high

low

none
Vector: CVSS:3.0/AV:N/AC:L/PR:N/UI:N/S:U/C:H/I:N/A:N Found at https://moodle.org/mod/forum/discuss.php?d=320291
Attack Vector (AV) Attack Complexity (AC) Privileges Required (PR) User Interaction (UI) Scope (S) Confidentiality Impact (C) Integrity Impact (I) Availability Impact (A)

network

adjacent_network

local

physical

low

high

none

low

high

none

required

unchanged

changed

high

low

none

high

low

none

high

low

none
Vector: CVSS:3.0/AV:N/AC:L/PR:N/UI:N/S:U/C:H/I:N/A:N Found at https://nvd.nist.gov/vuln/detail/CVE-2015-5267
Attack Vector (AV) Attack Complexity (AC) Privileges Required (PR) User Interaction (UI) Scope (S) Confidentiality Impact (C) Integrity Impact (I) Availability Impact (A)

network

adjacent_network

local

physical

low

high

none

low

high

none

required

unchanged

changed

high

low

none

high

low

none

high

low

none
Vector: CVSS:3.0/AV:N/AC:L/PR:N/UI:N/S:U/C:H/I:N/A:N Found at https://web.archive.org/web/20160323063809/http://www.securitytracker.com/id/1033619
Attack Vector (AV) Attack Complexity (AC) Privileges Required (PR) User Interaction (UI) Scope (S) Confidentiality Impact (C) Integrity Impact (I) Availability Impact (A)

network

adjacent_network

local

physical

low

high

none

low

high

none

required

unchanged

changed

high

low

none

high

low

none

high

low

none
Vector: CVSS:3.0/AV:N/AC:L/PR:N/UI:N/S:U/C:H/I:N/A:N Found at http://www.openwall.com/lists/oss-security/2015/09/21/1
Attack Vector (AV) Attack Complexity (AC) Privileges Required (PR) User Interaction (UI) Scope (S) Confidentiality Impact (C) Integrity Impact (I) Availability Impact (A)

network

adjacent_network

local

physical

low

high

none

low

high

none

required

unchanged

changed

high

low

none

high

low

none

high

low

none
Exploit Prediction Scoring System (EPSS)
Percentile 0.66506
EPSS Score 0.00537
Published At June 30, 2025, 12:55 p.m.
Date Actor Action Source VulnerableCode Version
2025-07-01T12:28:20.073779+00:00 GithubOSV Importer Import https://github.com/github/advisory-database/blob/main/advisories/github-reviewed/2022/05/GHSA-382v-gxj9-ffhc/GHSA-382v-gxj9-ffhc.json 36.1.3