Miggo Logo
Miggo Vulnerability Database
→
CVE-2015-5340

CVE-2015-5340: Moodle sensitive information disclosure

4.3

CVSS Score
3.0

Basic Information

CVE ID
CVE-2015-5340
GHSA ID
GHSA-mmvj-j7hq-rx85
EPSS Score
0.39233%
CWE
CWE-200
Published
5/13/2022
Updated
12/7/2023
KEV Status
No
Technology
TechnologyPHP

Technical Details

CVSS Vector
CVSS:3.0/AV:N/AC:L/PR:L/UI:N/S:U/C:L/I:N/A:N
Package NameEcosystemVulnerable VersionsFirst Patched Version
moodle/moodlecomposer<= 2.6.11
moodle/moodlecomposer>= 2.7.0, < 2.7.112.7.11
moodle/moodlecomposer>= 2.8.0, < 2.8.92.8.9
moodle/moodlecomposer>= 2.9.0, < 2.9.32.9.3

Vulnerability Intelligence
Miggo AIMiggo AI

Miggo AIRoot Cause Analysis

The vulnerability arises because the affected PHP scripts (overview.php and view.php) lacked a critical capability check. The commit explicitly adds require_capability('moodle/badges:viewbadges', $context) to overview.php, confirming its role. While the provided diff does not include view.php, the CVE/GHSA descriptions explicitly name both files as attack vectors. The absence of the capability check in these entry points allowed unauthorized access to badge information. Confidence is high for overview.php (directly patched) and medium for view.php (implied by advisory but no patch shown).

Vulnerable functions

Only Mi**o us*rs **n s** t*is s**tion

WAF Protection Rules

WAF Rule

Moo*l* t*rou** *.*.**, *.*.x ***or* *.*.**, *.*.x ***or* *.*.*, *n* *.*.x ***or* *.*.* *o*s not *onsi**r t** moo*l*/*****s:vi*w*****s **p**ility, w*i** *llows r*mot* *ut**nti**t** us*rs to o*t*in s*nsitiv* ***** in*orm*tion vi* * r*qu*st involvin* (*

Reasoning

T** vuln*r**ility *ris*s ****us* t** *****t** P*P s*ripts (ov*rvi*w.p*p *n* vi*w.p*p) l**k** * *riti**l **p**ility ****k. T** *ommit *xpli*itly ***s `r*quir*_**p**ility('moo*l*/*****s:vi*w*****s', $*ont*xt)` to ov*rvi*w.p*p, *on*irmin* its rol*. W*il