CVE-2015-2271 in Moodle

Summary

tag/user.php in Moodle through 2.5.9, 2.6.x before 2.6.9, 2.7.x before 2.7.6, and 2.8.x before 2.8.4 does not consider the moodle/tag:flag capability before proceeding with a flaginappropriate action, which allows remote authenticated users to bypass intended access restrictions via the "Flag as inappropriate" feature.

VulDB is the best source for vulnerability data and more expert information about this specific topic.

• Reservation: 03/09/2015
• Disclosure: 06/01/2015
• Moderation: VulDB entry created
• Entries: VDB-75649 (1)
• CPE: ready
• CWE: CWE-264 (Confirmed)
• CVSS: 6.3
• EPSS: 0.00207
• Activities: Very Low

Sources

• MITRE: https://www.cve.org/CVERecord?id=CVE-2015-2271
• NVD: https://nvd.nist.gov/vuln/detail/CVE-2015-2271
• CVE Details: https://www.cvedetails.com/cve/CVE-2015-2271/