Description

Moodle 2.9.x before 2.9.3 does not properly check the contact list before authorizing message transmission, which allows remote authenticated users to bypass intended access restrictions and conduct spam attacks via the messaging API.

Remediation

References

CVE-2015-5331

Related Vulnerabilities

Jenkins Insufficient Session Expiration Vulnerability (CVE-2019-1003004)

Drupal Improper Neutralization of Input During Web Page Generation ('Cross-site Scripting') Vulnerability (CVE-2009-4371)

WordPress Plugin Appointment Booking Calendar Cross-Site Scripting (1.3.18)

OpenSSL Exposure of Sensitive Information to an Unauthorized Actor Vulnerability (CVE-2017-3736)

phpMyAdmin Improper Input Validation Vulnerability (CVE-2016-9858)

Severity

Medium

Classification

CVE-2015-5331 CVSS:3.0/AV:N/AC:L/PR:L/UI:N/S:U/C:N/I:L/A:N

Tags

Missing Update Known Vulnerabilities