CVE-2015-5266
Summary
| CVE | CVE-2015-5266 |
|---|---|
| State | PUBLISHED |
| Assigner | redhat |
| Source Priority | CVE Program / NVD first with legacy fallback |
| Published | 2016-02-22 05:59:06 UTC |
| Updated | 2026-05-06 22:30:45 UTC |
| Description | The enrol_meta_sync function in enrol/meta/locallib.php in Moodle through 2.6.11, 2.7.x before 2.7.10, 2.8.x before 2.8.8, and 2.9.x before 2.9.2 allows remote authenticated users to obtain manager privileges in opportunistic circumstances by leveraging incorrect role processing during a long-running sync script. |
Risk And Classification
Primary CVSS: v3.0 6.8 MEDIUM from [email protected]
CVSS:3.0/AV:N/AC:H/PR:L/UI:N/S:U/C:H/I:H/A:N
Problem Types: CWE-264 | n/a
| Version | Source | Type | Score | Severity | Vector |
|---|---|---|---|---|---|
| 3.0 | [email protected] | Primary | 6.8 | MEDIUM | CVSS:3.0/AV:N/AC:H/PR:L/UI:N/S:U/C:H/I:H/A:N |
| 2.0 | [email protected] | Primary | 4.9 | AV:N/AC:M/Au:S/C:P/I:P/A:N |
CVSS v3.0 Breakdown
Attack Vector
NetworkAttack Complexity
HighPrivileges Required
LowUser Interaction
NoneScope
UnchangedConfidentiality
HighIntegrity
HighAvailability
NoneCVSS:3.0/AV:N/AC:H/PR:L/UI:N/S:U/C:H/I:H/A:N
CVSS v2.0 Breakdown
Access Vector
NetworkAccess Complexity
MediumAuthentication
SingleConfidentiality
PartialIntegrity
PartialAvailability
NoneAV:N/AC:M/Au:S/C:P/I:P/A:N
NVD Known Affected Configurations (CPE 2.3)
| Type | Vendor | Product | Version | Update | Edition | Language |
|---|---|---|---|---|---|---|
| Application | Moodle | Moodle | 2.7.0 | All | All | All |
| Application | Moodle | Moodle | 2.7.1 | All | All | All |
| Application | Moodle | Moodle | 2.7.2 | All | All | All |
| Application | Moodle | Moodle | 2.7.3 | All | All | All |
| Application | Moodle | Moodle | 2.7.4 | All | All | All |
| Application | Moodle | Moodle | 2.7.5 | All | All | All |
| Application | Moodle | Moodle | 2.7.6 | All | All | All |
| Application | Moodle | Moodle | 2.7.7 | All | All | All |
| Application | Moodle | Moodle | 2.7.8 | All | All | All |
| Application | Moodle | Moodle | 2.7.9 | All | All | All |
| Application | Moodle | Moodle | 2.8.0 | All | All | All |
| Application | Moodle | Moodle | 2.8.1 | All | All | All |
| Application | Moodle | Moodle | 2.8.2 | All | All | All |
| Application | Moodle | Moodle | 2.8.3 | All | All | All |
| Application | Moodle | Moodle | 2.8.4 | All | All | All |
| Application | Moodle | Moodle | 2.8.5 | All | All | All |
| Application | Moodle | Moodle | 2.8.6 | All | All | All |
| Application | Moodle | Moodle | 2.8.7 | All | All | All |
| Application | Moodle | Moodle | 2.9.0 | All | All | All |
| Application | Moodle | Moodle | 2.9.1 | All | All | All |
| Application | Moodle | Moodle | All | All | All | All |
Vendor Declared Affected Products
References
| Reference | Source | Link | Tags |
|---|---|---|---|
| Official Moodle git projects - moodle.git/search | af854a3a-2127-422b-91ae-364da2661108 | git.moodle.org | |
| Moodle Multiple Flaws Let Remote Users Guess Password Recovery Tokens and Remote Authenticated Users Access Data, Delete Files, and Conduct Cross-Site Scripting Attacks - SecurityTracker | af854a3a-2127-422b-91ae-364da2661108 | www.securitytracker.com | |
| Moodle.org: MSA-15-0033: Meta course synchronisation enrols suspended students as managers for a short period of time | af854a3a-2127-422b-91ae-364da2661108 | moodle.org | Vendor Advisory |
| oss-security - Moodle security release | af854a3a-2127-422b-91ae-364da2661108 | www.openwall.com | |
| CVE Program record | CVE.ORG | www.cve.org | canonical |
| NVD vulnerability detail | NVD | nvd.nist.gov | canonical, analysis |
No vendor comments have been submitted for this CVE.
There are currently no legacy QID mappings associated with this CVE.