The enrol_meta_sync function in enrol/meta/locallib.php in Moodle through 2.6.11, 2.7.x before 2.7.10, 2.8.x before 2.8.8, and 2.9.x before 2.9.2 allows remote authenticated users to obtain manager privileges in opportunistic circumstances by leveraging incorrect role processing during a long-running sync script.

Security update.

Note that Tenable Network Security has extracted the preceding description block directly from the Fedora security advisory. Tenable has attempted to automatically clean and format it as much as possible without introducing additional issues.

Moodle, an open-source course management system, installed on the remote host is version 2.7.x prior to 2.7.10, 2.8.x prior to 2.8.8, or 2.9.x prior to 2.9.2, and is affected by multiple vulnerabilities :

  - A flaw due to the program failing to restrict users properly allowing an authenticated remote attacker to delete arbitrary files uploaded from other users. (CVE-2015-5265) 
 - A race condition in the 'enrol/meta/locallib.php' script that can allow suspended students to get assigned a manager role in meta course for several minutes allowing an authenticated remote attacker to gain elevated privileges. (CVE-2015-5266) 
 - A flaw in the 'complex_random_string()' function in the 'lib/moodlelib.php' script that is due to the limitation of PHP randomization. This can cause the program to create predictable password recovery tokens. (CVE-2015-5267) 
 - A flaw in the lesson module that is due to the program failing to protect against making new attempts to answer some questions allowing an authenticated remote attacker to re-attempt answering questions in the lesson. (CVE-2015-5264) 
 - A flaw in the rating component that is due to the program failing to check separate groups allowing an authenticated remote attacker to view ratings from other groups. (CVE-2015-5268) 
 - A flaw that allows a stored cross-site scripting (XSS) attack. This flaw exists because the 'group/overview.php' script does not validate input to grouping descriptions before returning it to users. This may allow an authenticated, remote attacker to create a specially crafted request that would execute arbitrary script code in a user's browser session within the trust relationship between their browser and the server. (CVE-2015-5269) 
 - A flaw due to the program failing to check group access when posting to 'all participants' in forum allowing a remote attacker to bypass access restrictions and post to arbitrary locations. (CVE-2015-5272)

Moodle Release Notes report :

MSA-15-0030: Students can re-attempt answering questions in the lesson (CVE-2015-5264)

MSA-15-0031: Teacher in forum can still post to 'all participants' and groups they are not members of (CVE-2015-5272 - 2.7.10 only)

MSA-15-0032: Users can delete files uploaded by other users in wiki (CVE-2015-5265)

MSA-15-0033: Meta course synchronization enrolls suspended students as managers for a short period of time (CVE-2015-5266)

MSA-15-0034: Vulnerability in password recovery mechanism (CVE-2015-5267)

MSA-15-0035: Rating component does not check separate groups (CVE-2015-5268)

MSA-15-0036: XSS in grouping description (CVE-2015-5269)

ID	Name	Product	Family	Severity
89333	Fedora 23 : moodle-2.9.3-1.fc23 (2015-98fc0d20ad)	Nessus	Fedora Local Security Checks	high
89194	Fedora 22 : moodle-2.8.9-1.fc22 (2015-2ebdd4ad8f)	Nessus	Fedora Local Security Checks	high
8969	Moodle 2.7.x < 2.7.10 / 2.8.x < 2.8.8 / 2.9.x < 2.9.2 Multiple Vulnerabilities	Nessus Network Monitor	CGI	high
85995	FreeBSD : moodle -- multiple vulnerabilities (c2fcbec2-5daa-11e5-9909-002590263bf5)	Nessus	FreeBSD Local Security Checks	high

Detections

Analytics

CVE-2015-5266

medium

Tenable Plugins

high

high

high

high