Description

Moodle 2.8.x before 2.8.6 does not consider the tool/monitor:subscribe capability before entering subscriptions to site-wide event-monitor rules, which allows remote authenticated users to obtain sensitive information via a subscription request.

Remediation

References

CVE-2015-3177

Related Vulnerabilities

WordPress Plugin WP Travel-Best Travel Booking, Tour Management Engine Cross-Site Request Forgery (4.4.6)

WordPress Plugin Fitness Trainer-Training Membership Cross-Site Scripting (1.0.8)

Serendipity Other Vulnerability (CVE-2005-1448)

WordPress Plugin Clever Addons for Elementor Multiple Cross-Site Scripting Vulnerabilities (2.0.15)

WordPress Plugin Post SMTP-WP SMTP with Email Logs & Mobile App for Failure Alerts-Any SMTP Plus Gmail SMTP, Office 365, Brevo, Mailgun, Amazon SES, Postmark Cross-Site Scripting (2.8.7)

Severity

Low

Classification

CVE-2015-3177

Tags

Missing Update Known Vulnerabilities