MGASA-2015-0229

    Dashboard / Vulnerabilities / MGASA-2015-0229

    MGASA-2015-0229

    Published: 18 May 2015Last Modified: 16 Apr 2026

    Summary: Updated moodle packages fix security vulnerabilities

    Details: Updated moodle package fixes security vulnerabilities: In Moodle before 2.6.11, leaving gradebook feedback is a trusted action and such capabilities in other modules already have an XSS mask, 'mod/quiz:grade' was missing this flag (CVE-2015-3174). In Moodle before 2.6.11, some error messages display a button to return to the previous page. Redirecting to non-local referer should not be allowed as it can potentially be used for phising (CVE-2015-3175). In Moodle before 2.6.11, on sites with enabled self-registration, not registered users can retrieve fullname of registered users if they know their usernames (CVE-2015-3176). In Moodle before 2.6.11, if a user who is not XSS-trusted attempts to insert a script as part of the input text, it will be cleaned when displayed on the Moodle website but may be displayed uncleaned in the external application because external_format_text() cleans and formats text incorrectly when returning it from Web Services (CVE-2015-3178). In Moodle before 2.6.11, when self-registration is enabled and a user's account was suspended after creating the account but before actually confirming it, the user is still able to login when confirming their email, but only once (CVE-2015-3179). In Moodle before 2.6.11, if a user is enrolled in the course but his enrollment is suspended, they can not access the course but still were able to see the course structure in the navigation block (CVE-2015-3180). In Moodle before 2.6.11, users with the revoked capability 'moodle/user:manageownfiles' are still able to upload private files using a deprecated function in Web Services (CVE-2015-3181).

    References: https://advisories.mageia.org/MGASA-2015-0229.html, https://bugs.mageia.org/show_bug.cgi?id=15909, https://moodle.org/mod/forum/discuss.php?d=313681, https://moodle.org/mod/forum/discuss.php?d=313682, https://moodle.org/mod/forum/discuss.php?d=313683, https://moodle.org/mod/forum/discuss.php?d=313685, https://moodle.org/mod/forum/discuss.php?d=313686, https://moodle.org/mod/forum/discuss.php?d=313687, https://moodle.org/mod/forum/discuss.php?d=313688, https://docs.moodle.org/dev/Moodle_2.6.11_release_notes, https://moodle.org/mod/forum/discuss.php?d=313322

    Affected packages

    Package

    Name: moodle

    Purl: pkg:rpm/mageia/moodle?arch=source&distro=mageia-4

    Affected ranges

    Type: ECOSYSTEM

    Events:

    Introduced- 0
    Fixed -2.6.11-1.mga4

    Affected versions

    Common Vulnerability Scoring System

    Attack Vector
    Network
    Adjacent
    Local
    Physical
    Privileges Required
    None
    Low
    High
    User Interaction
    None
    Required
    Scope
    Unchanged
    Changed
    Confidentiality
    None
    Low
    High
    Integrity
    None
    Low
    High
    Availability
    None
    Low
    High
    MGASA-2015-0229 | CVE-DB