Description

The enrol_meta_sync function in enrol/meta/locallib.php in Moodle through 2.6.11, 2.7.x before 2.7.10, 2.8.x before 2.8.8, and 2.9.x before 2.9.2 allows remote authenticated users to obtain manager privileges in opportunistic circumstances by leveraging incorrect role processing during a long-running sync script.

Remediation

References

CVE-2015-5266

Related Vulnerabilities

Apache HTTP Server Session Fixation Vulnerability (CVE-2001-1534)

WordPress Plugin WooCommerce Cross-Site Request Forgery (3.6.4)

Varnish Cache Other Vulnerability (CVE-2013-4090)

WordPress Plugin Comment System for WordPress & Ajax Comments-Comment Press Cross-Frame Scripting (2.7.0)

WordPress Other Vulnerability (CVE-2005-4463)

Severity

Medium

Classification

CVE-2015-5266 CWE-264 CVSS:3.0/AV:N/AC:H/PR:L/UI:N/S:U/C:H/I:H/A:N

Tags

Missing Update Known Vulnerabilities