MGASA-2015-0381

    Dashboard / Vulnerabilities / MGASA-2015-0381

    MGASA-2015-0381

    Published: 23 Sept 2015Last Modified: 16 Apr 2026

    Summary: Updated moodle packages fix security vulnerabilities

    Details: Updated moodle package fixes security vulnerabilities: In Moodle before 2.8.8, completed and graded lesson activity was not protected against making new attempts to answer some questions, so students could re-attempt answering questions in the lesson (CVE-2015-5264). In Moodle before 2.8.8, users could delete files uploaded by other users in wiki (CVE-2015-5265). In Moodle before 2.8.8, meta course synchronisation enrols suspended students as managers for a short period of time and causes large database growth. On large installations, when the sync script takes a long time, suspended students may get assigned a manager role in meta course for several minutes (CVE-2015-5266) In Moodle before 2.8.8, password recovery tokens can be guessed because of php randomisation limitations (CVE-2015-5267). In Moodle before 2.8.8, when viewing ratings, the group access was not properly checked, allowing users from other groups to view ratings (CVE-2015-5268). In Moodle before 2.8.8, capability to manage groups does not have XSS risk, however it was possible to add XSS to the grouping description (CVE-2015-5269). The moodle package has been updated to version 2.8.8, fixing these issues and several other bugs. Additionally, the preg plugin has been updated to version 2.8, and the OU Multiple Response question type and UIkit theme have been added to the package.

    References: https://advisories.mageia.org/MGASA-2015-0381.html, https://bugs.mageia.org/show_bug.cgi?id=16767, https://moodle.org/mod/forum/discuss.php?d=320287, https://moodle.org/mod/forum/discuss.php?d=320289, https://moodle.org/mod/forum/discuss.php?d=320290, https://moodle.org/mod/forum/discuss.php?d=320291, https://moodle.org/mod/forum/discuss.php?d=320292, https://moodle.org/mod/forum/discuss.php?d=320293, https://docs.moodle.org/dev/Moodle_2.8.8_release_notes, https://moodle.org/mod/forum/discuss.php?d=319884, https://bitbucket.org/oasychev/moodle-plugins/, https://moodle.org/plugins/view/qtype_oumultiresponse, https://moodle.org/plugins/view/theme_uikit

    Affected packages

    Package

    Name: moodle

    Purl: pkg:rpm/mageia/moodle?arch=source&distro=mageia-5

    Affected ranges

    Type: ECOSYSTEM

    Events:

    Introduced- 0
    Fixed -2.8.8-1.mga5

    Affected versions

    Common Vulnerability Scoring System

    Attack Vector
    Network
    Adjacent
    Local
    Physical
    Privileges Required
    None
    Low
    High
    User Interaction
    None
    Required
    Scope
    Unchanged
    Changed
    Confidentiality
    None
    Low
    High
    Integrity
    None
    Low
    High
    Availability
    None
    Low
    High
    MGASA-2015-0381 | CVE-DB