Open redirect vulnerability in the clean_param function in lib/moodlelib.php in Moodle through 2.6.11, 2.7.x before 2.7.9, 2.8.x before 2.8.7, and 2.9.x before 2.9.1 allows remote attackers to redirect users to arbitrary web sites and conduct phishing attacks via vectors involving an HTTP Referer header that has a substring match with a local URL.

Moodle, an open-source course management system, installed on the remote host is version 2.7.x prior to 2.7.9, 2.8.x prior to 2.8.7, or 2.9.x prior to 2.9.1, and is affected by multiple vulnerabilities :

  - A flaw in the 'clean_param()' function in 'lib/moodlelib.php' that allows a cross-site redirection attack. This flaw exists because the application does not validate a certain parameter when generating error messages and allows a context-dependent attacker to create a specially crafted link that, if followed, would redirect a victim from the intended legitimate web site to an arbitrary web site of the attacker's choosing. (CVE-2015-3272) 
 - A flaw in the 'mod/forum/post.php' script that is due to missing capability checks allowing an unauthorized remote attacker to post on the forum. (CVE-2015-3273) 
 - A flaw that allows a stored cross-site scripting (XSS) attack. This flaw exists because the 'user_get_user_details()' function in the 'user/lib.php' script does not validate input to text profile fields before returning it to users allowing an authenticated remote attacker to create a specially crafted request that would execute arbitrary script code in a user's browser session within the trust relationship between their browser and the server. (CVE-2015-3274) 
 - A flaw in the 'mod/scorm/prereqs.php' and 'mod/scorm/player.php' scripts that are triggered during the handling of the 'currentorg' parameter allowing a remote attacker to inject arbitrary JavaScript content. (CVE-2015-3275)

moodle-2.9.1-1.fc23 - 2.9.1

Note that Tenable Network Security has extracted the preceding description block directly from the Fedora security advisory. Tenable has attempted to automatically clean and format it as much as possible without introducing additional issues.

moodle-2.7.9-1.fc21 - 2.7.9.

Note that Tenable Network Security has extracted the preceding description block directly from the Fedora security advisory. Tenable has attempted to automatically clean and format it as much as possible without introducing additional issues.

moodle-2.8.7-1.fc22 - Latest upstream release.

Note that Tenable Network Security has extracted the preceding description block directly from the Fedora security advisory. Tenable has attempted to automatically clean and format it as much as possible without introducing additional issues.

Marina Glancy reports :

MSA-15-0026: Possible phishing when redirecting to external site using referer header. (CVE-2015-3272)

MSA-15-0027: Capability 'mod/forum:canposttomygroups' is not respected when using 'Post a copy to all groups' in forum (CVE-2015-3273)

MSA-15-0028: Possible XSS through custom text profile fields in Web Services (CVE-2015-3274)

MSA-15-0029: JavaScript injection in SCORM module (CVE-2015-3275)

ID	Name	Product	Family	Severity
8968	Moodle 2.7.x < 2.7.9 / 2.8.x < 2.8.7 / 2.9.x < 2.9.1 Multiple Vulnerabilities	Nessus Network Monitor	CGI	critical
86032	Fedora 23 : moodle-2.9.1-1.fc23 (2015-14987)	Nessus	Fedora Local Security Checks	high
85956	Fedora 21 : moodle-2.7.9-1.fc21 (2015-14996)	Nessus	Fedora Local Security Checks	high
85955	Fedora 22 : moodle-2.8.7-1.fc22 (2015-14988)	Nessus	Fedora Local Security Checks	high
84861	FreeBSD : moodle -- multiple vulnerabilities (43891162-2d5e-11e5-a4a5-002590263bf5)	Nessus	FreeBSD Local Security Checks	high

Detections

Analytics

CVE-2015-3272

high

Tenable Plugins

critical

high

high

high

high