CVE-2015-5338 json
Moodle multiple cross-site request forgery (CSRF) vulnerabilities
published 2016-02-22 10 y ago modified 2026-06-17 4 mo ago also GHSA-v33x-q8gh-4x42 , EUVD-2022-5265
- cvss
- 8.8
- version 3.0, NVD
- cisa kev
- Not listed
- not in CISA's catalog
- epss
- 0.8%
- EPSS 0.8% chance of exploitation in 30 days, percentile 56%
- public exploits
- 0
- none known
Summary
Multiple cross-site request forgery (CSRF) vulnerabilities in the lesson module in Moodle through 2.6.11, 2.7.x before 2.7.11, 2.8.x before 2.8.9, and 2.9.x before 2.9.3 allow remote attackers to hijack the authentication of arbitrary users for requests to (1) mod/lesson/mediafile.php or (2) mod/lesson/view.php.
Patch / fix
- packagist moodle/moodle 2.7.11, 2.8.9, 2.9.3
Vendor advisories
What the vendors themselves say about their products: affected, fixed or not affected, and what to do.
red hat product security vex CVE-2015-5338 updated
moodle: Multiple security issues fixed in 2.7.11, 2.8.9, 2.9.3
-
Red Hat All currently supported Red Hat productsnot affected: vulnerable code not present
Red Hat CSAF VEX © Red Hat, Inc., from https://security.access.redhat.com/data/csaf/v2/vex/; changed: reduced to product statuses and remediations. CC BY 4.0 · csaf
Exploit prediction
0.79% chance of exploitation in the next 30 days, higher than 56% of all scored CVEs (FIRST EPSS, 2026-11-09).
CVSS scores
| assigned by | version | score | vector |
|---|---|---|---|
| NVD | 3.0 | 8.8 | CVSS:3.0/AV:N/AC:L/PR:N/UI:R/S:U/C:H/I:H/A:H |
| NVD | 2.0 | 6.8 | AV:N/AC:M/Au:N/C:P/I:P/A:P |
| GitHub | 3.0 | 8.8 | CVSS:3.0/AV:N/AC:L/PR:N/UI:R/S:U/C:H/I:H/A:H |
Affected packages
| ecosystem | package | affected | fixed in |
|---|---|---|---|
| packagist | moodle/moodle | <2.7.11 >=2.8.0, <2.8.9 >=2.9.0, <2.9.3 |
2.7.11 2.8.9 2.9.3 |
Classification
- Weakness
-
- CWE-352 Cross-Site Request Forgery
References
-
github.com
/moodle/moodle/commit/541c5b8552e0162010d0259c90a04eb63e875958
web
-
github.com
/moodle/moodle/commit/817cae1ac7ca748ba368439a40ef67d555774485
web
-
github.com
/moodle/moodle/commit/dcb42c9ed13b0c0ec2dde22b62ef69772d7725e6
web
-
github.com
/moodle/moodle/commit/f75333766c7295932baa72a9dbe9542baf14e107
web
-
moodle.org
/mod/forum/discuss.php?d=323233
web, vendor-advisory
-
git.moodle.org
/gw?p=moodle.git&a=search&h=HEAD&st=commit&s=MDL-48109
web
-
nvd.nist.gov
/vuln/detail/CVE-2015-5338
advisory
Sources
- CVE List CVE-2015-5338
- GitHub Advisory GHSA-v33x-q8gh-4x42
- NVD CVE-2015-5338
Fencer Intel keeps one entry per vulnerability: the CVE id wins, then GHSA, and records that alias each other are merged, except that two CVEs always keep separate entries. The same data is available as JSON.