Staging Environment: Content and features may be unstable or change without notice.
Search for vulnerabilities
Vulnerability details: VCID-trvp-xzf5-pff8
Vulnerability ID VCID-trvp-xzf5-pff8
Aliases CVE-2015-5338
GHSA-v33x-q8gh-4x42
Summary Cross-Site Request Forgery (CSRF) Multiple cross-site request forgery (CSRF) vulnerabilities in the lesson module in Moodle through 2.6.11, 2.7.x before 2.7.11, 2.8.x before 2.8.9, and 2.9.x before 2.9.3 allow remote attackers to hijack the authentication of arbitrary users for requests to (1) mod/lesson/mediafile.php or (2) mod/lesson/view.php.
Status Published
Exploitability None
Weighted Severity None
Risk None
Affected and Fixed Packages Package Details
Weaknesses (3)
CWE-1035 OWASP Top Ten 2017 Category A9 - Using Components with Known Vulnerabilities
CWE-352 Cross-Site Request Forgery (CSRF)
CWE-937 OWASP Top Ten 2013 Category A9 - Using Components with Known Vulnerabilities
System Score Found at
There are no known severity scores.
Reference id Reference type URL
http://git.moodle.org/gw?p=moodle.git&a=search&h=HEAD&st=commit&s=MDL-48109
https://github.com/moodle/moodle/commit/541c5b8552e0162010d0259c90a04eb63e875958
https://github.com/moodle/moodle/commit/817cae1ac7ca748ba368439a40ef67d555774485
https://github.com/moodle/moodle/commit/dcb42c9ed13b0c0ec2dde22b62ef69772d7725e6
https://github.com/moodle/moodle/commit/f75333766c7295932baa72a9dbe9542baf14e107
https://moodle.org/mod/forum/discuss.php?d=323233
CVE-2015-5338 https://nvd.nist.gov/vuln/detail/CVE-2015-5338
GHSA-v33x-q8gh-4x42 https://github.com/advisories/GHSA-v33x-q8gh-4x42
No exploits are available.
There are no known vectors.

No EPSS data available for this vulnerability.

Date Actor Action Source VulnerableCode Version
2026-06-02T04:43:03.773808+00:00 GitLab Importer Import https://gitlab.com/gitlab-org/advisories-community/-/blob/main/packagist/moodle/moodle/CVE-2015-5338.yml 38.6.0