Description

Moodle 2.9.x before 2.9.3 does not properly check the contact list before authorizing message transmission, which allows remote authenticated users to bypass intended access restrictions and conduct spam attacks via the messaging API.

Remediation

References

CVE-2015-5331

Related Vulnerabilities

Apache HTTP Server Integer Overflow or Wraparound Vulnerability (CVE-2025-55753)

Roundcube Improper Neutralization of Input During Web Page Generation ('Cross-site Scripting') Vulnerability (CVE-2021-44025)

XWiki Improper Neutralization of Special Elements in Output Used by a Downstream Component ('Injection') Vulnerability (CVE-2023-36470)

WordPress Plugin WP RSS Aggregator-News Feeds, Autoblogging, Youtube Video Feeds and More Multiple Unspecified Vulnerabilities (4.6.8)

WordPress Plugin Yakadanda Google+ Hangout Events Cross-Site Scripting (0.3.7)

Severity

Medium

Classification

CVSS:3.0/AV:N/AC:L/PR:L/UI:N/S:U/C:N/I:L/A:N

Tags

Missing Update Known Vulnerabilities CVE-2015-5331