Description

The enrol_meta_sync function in enrol/meta/locallib.php in Moodle through 2.6.11, 2.7.x before 2.7.10, 2.8.x before 2.8.8, and 2.9.x before 2.9.2 allows remote authenticated users to obtain manager privileges in opportunistic circumstances by leveraging incorrect role processing during a long-running sync script.

Remediation

References

CVE-2015-5266

Related Vulnerabilities

phpList Improper Neutralization of Input During Web Page Generation ('Cross-site Scripting') Vulnerability (CVE-2020-22251)

WordPress Plugin Count per Day Information Disclosure (3.2.5)

Oracle HTTP Server NULL Pointer Dereference Vulnerability (CVE-2019-10097)

Oracle Database Server CVE-2015-2629 Vulnerability (CVE-2015-2629)

Apache Tomcat Configuration Vulnerability (CVE-2008-0128)

Severity

Medium

Classification

CVE-2015-5266 CWE-264 CVSS:3.0/AV:N/AC:H/PR:L/UI:N/S:U/C:H/I:H/A:N

Tags

Missing Update Known Vulnerabilities