CVE-2015-5335

MEDIUM

Moodle < 2.6.11, 2.7.x < 2.7.11, 2.8.x < 2.8.9, 2.9.x < 2.9.3 - Cross-Site Request Forgery via Registration Hub URL

Title source: llm

Description

Cross-site request forgery (CSRF) vulnerability in admin/registration/register.php in Moodle through 2.6.11, 2.7.x before 2.7.11, 2.8.x before 2.8.9, and 2.9.x before 2.9.3 allows remote attackers to hijack the authentication of administrators for requests that send statistics to an arbitrary hub URL.

References (2)

Core 2

Core References

Patch x_refsource_confirm

http://git.moodle.org/gw?p=moodle.git&a=search&h=HEAD&st=commit&s=MDL-51091

Vendor Advisory x_refsource_confirm

https://moodle.org/mod/forum/discuss.php?d=323230

Scores

CVSS v3 4.3

EPSS 0.0007

EPSS Percentile 20.8%

Attack Vector NETWORK

CVSS:3.0/AV:N/AC:L/PR:N/UI:R/S:U/C:L/I:N/A:N

Details

CWE

CWE-200 CWE-352

Status published

Products (25)

moodle/moodle 2.7.0

moodle/moodle 2.7.1

moodle/moodle 2.7.2

moodle/moodle 2.7.3

moodle/moodle 2.7.4

moodle/moodle 2.7.5

moodle/moodle 2.7.6

moodle/moodle 2.7.7

moodle/moodle 2.7.8

moodle/moodle 2.7.9

... and 15 more

Published Feb 22, 2016

Tracked Since Feb 18, 2026