Description

Multiple cross-site request forgery (CSRF) vulnerabilities in the lesson module in Moodle through 2.6.11, 2.7.x before 2.7.11, 2.8.x before 2.8.9, and 2.9.x before 2.9.3 allow remote attackers to hijack the authentication of arbitrary users for requests to (1) mod/lesson/mediafile.php or (2) mod/lesson/view.php.

Remediation

References

CVE-2015-5338

Related Vulnerabilities

WordPress Insecure Default Initialization of Resource Vulnerability (CVE-2017-5491)

Oracle Application Server Other Vulnerability (CVE-2000-1235)

OpenSSL Improper Input Validation Vulnerability (CVE-2013-4353)

phpMyFAQ Improper Neutralization of Input During Web Page Generation ('Cross-site Scripting') Vulnerability (CVE-2009-4780)

IBM WebSEAL Improper Neutralization of Special Elements used in an OS Command ('OS Command Injection') Vulnerability (CVE-2016-3028)

Severity

High

Classification

CVE-2015-5338 CWE-352 CVSS:3.0/AV:N/AC:L/PR:N/UI:R/S:U/C:H/I:H/A:H

Tags

Missing Update Known Vulnerabilities