Description

Moodle 2.9.x before 2.9.3 does not properly check the contact list before authorizing message transmission, which allows remote authenticated users to bypass intended access restrictions and conduct spam attacks via the messaging API.

Remediation

References

CVE-2015-5331

Related Vulnerabilities

WordPress Plugin WP Smart Import: Import any XML File to WordPress Server-Side Request Forgery (1.0.0)

WordPress Plugin WORDPRESS VIDEO GALLERY SQL Injection (2.7)

WordPress Plugin Mailing List 'dl.php' Arbitrary File Download (1.4.1)

MediaWiki Use of a Broken or Risky Cryptographic Algorithm Vulnerability (CVE-2021-31556)

Hesk Improper Neutralization of Input During Web Page Generation ('Cross-site Scripting') Vulnerability (CVE-2011-5287)

Severity

Medium

Classification

CVE-2015-5331 CVSS:3.0/AV:N/AC:L/PR:L/UI:N/S:U/C:N/I:L/A:N

Tags

Missing Update Known Vulnerabilities