CVE-2015-5272

MediumCVSS 4.3/10Last modified Jun 17, 2026

Description

The Forum module in Moodle 2.7.x before 2.7.10 allows remote authenticated users to post to arbitrary groups by leveraging the teacher role, as demonstrated by a post directed to "all participants."

Metrics

CVSS 3.0 4.3/10CVSS:3.0/AV:N/AC:L/PR:L/UI:N/S:U/C:N/I:L/A:N

Weakness enumeration

CWE-264

Affected software

VendorProductVersions
n/an/an/a

References

Timeline

Published
Feb 22, 2016
Last modified
Jun 17, 2026
NVD status
Modified

Related CVEs from 2015

CVE-2015-52733.6The abrt-action-install-debuginfo-to-abrt-cache help program in Automatic Bug Reporting Tool (ABRT) before 2.7.1 allows local users to writeCVE-2015-52746.5rubygem-openshift-origin-console in Red Hat OpenShift 2.2 allows remote authenticated users to execute arbitrary commands via a crafted requCVE-2015-52765.0The std::random_device class in libstdc++ in the GNU Compiler Collection (aka GCC) before 4.9.4 does not properly handle short reads from blCVE-2015-52777.2The get_contents function in nss_files/files-XXX.c in the Name Service Switch (NSS) in GNU C Library (aka glibc or libc6) before 2.20 might CVE-2015-52786.5The ne2000_receive function in hw/net/ne2000.c in QEMU before 2.4.0.1 allows attackers to cause a denial of service (infinite loop and instaCVE-2015-52797.2Heap-based buffer overflow in the ne2000_receive function in hw/net/ne2000.c in QEMU before 2.4.0.1 allows guest OS users to cause a denial CVE-2015-52812.6The grub2 package before 2.02-0.29 in Red Hat Enterprise Linux (RHEL) 7, when used on UEFI systems, allows local users to bypass intended SeCVE-2015-52826.1Cross-site scripting (XSS) vulnerability in Foreman 1.7.0 and after.CVE-2015-52834.7The sctp_init function in net/sctp/protocol.c in the Linux kernel before 4.2.3 has an incorrect sequence of protocol-initialization steps, wCVE-2015-52849.8ipa-kra-install in FreeIPA before 4.2.2 puts the CA agent certificate and private key in /etc/httpd/alias/kra-agent.pem, which is world readCVE-2015-52855.0CRLF injection vulnerability in Kallithea before 0.3 allows remote attackers to inject arbitrary HTTP headers and conduct HTTP response spliCVE-2015-52866.8OpenStack Image Service (Glance) before 2014.2.4 (juno) and 2015.1.x before 2015.1.2 (kilo) allows remote authenticated users to bypass the
CVE-2015-5272: Medium severity, CVSS 4.3 | Vulnix