Vulnerability CVE-2015-3275

Vulnerability Name:

CVE-2015-3275 (CCN-104541)

Assigned:

2015-07-13

Published:

2015-07-13

Updated:

2020-12-01

Summary:

Multiple cross-site scripting (XSS) vulnerabilities in the SCORM module in Moodle through 2.6.11, 2.7.x before 2.7.9, 2.8.x before 2.8.7, and 2.9.x before 2.9.1 allow remote attackers to inject arbitrary web script or HTML via a crafted organization name to (1) mod/scorm/player.php or (2) mod/scorm/prereqs.php.

CVSS v3 Severity:

6.1 Medium (CVSS v3.1 Vector: CVSS:3.1/AV:N/AC:L/PR:N/UI:R/S:C/C:L/I:L/A:N)
5.3 Medium (Temporal CVSS v3.1 Vector: CVSS:3.1/AV:N/AC:L/PR:N/UI:R/S:C/C:L/I:L/A:N/E:U/RL:O/RC:C)

Exploitability Metrics:	Attack Vector (AV): Network Attack Complexity (AC): Low Privileges Required (PR): None User Interaction (UI): Required
Scope:	Scope (S): Changed
Impact Metrics:	Confidentiality (C): Low Integrity (I): Low Availibility (A): None

7.3 High (CCN CVSS v3.1 Vector: CVSS:3.1/AV:N/AC:L/PR:N/UI:N/S:U/C:L/I:L/A:L)
6.4 Medium (CCN Temporal CVSS v3.1 Vector: CVSS:3.1/AV:N/AC:L/PR:N/UI:N/S:U/C:L/I:L/A:L/E:U/RL:O/RC:C)

Exploitability Metrics:	Attack Vector (AV): Network Attack Complexity (AC): Low Privileges Required (PR): None User Interaction (UI): None
Scope:	Scope (S): Unchanged
Impact Metrics:	Confidentiality (C): Low Integrity (I): Low Availibility (A): Low

CVSS v2 Severity:

4.3 Medium (CVSS v2 Vector: AV:N/AC:M/Au:N/C:N/I:P/A:N)

Exploitability Metrics:	Access Vector (AV): Network Access Complexity (AC): Medium Authentication (Au): None
Impact Metrics:	Confidentiality (C): None Integrity (I): Partial Availibility (A): None

7.5 High (CCN CVSS v2 Vector: AV:N/AC:L/Au:N/C:P/I:P/A:P)

Exploitability Metrics:	Access Vector (AV): Network Access Complexity (AC): Low Athentication (Au): None
Impact Metrics:	Confidentiality (C): Partial Integrity (I): Partial Availibility (A): Partial

Vulnerability Type:

CWE-79

Vulnerability Consequences:

Gain Access

References:

Source: MITRE
Type: CNA
CVE-2015-3275

Source: CONFIRM
Type: UNKNOWN
http://git.moodle.org/gw?p=moodle.git&a=search&h=HEAD&st=commit&s=MDL-50614

Source: MLIST
Type: UNKNOWN
[oss-security] 20150713 moodle security announcements

Source: SECTRACK
Type: UNKNOWN
1032877

Source: XF
Type: UNKNOWN
moodle-cve20153275-code-exec(104541)

Source: CONFIRM
Type: Vendor Advisory
https://moodle.org/mod/forum/discuss.php?d=316665

Source: CCN
Type: Moodle Security Advisory MSA-15-0029
Javascript injection in SCORM module

Source: CCN
Type: WhiteSource Vulnerability Database
CVE-2015-3275

Vulnerable Configuration:

Configuration 1:

cpe:/a:moodle:moodle:2.9.0:*:*:*:*:*:*:*

OR cpe:/a:moodle:moodle:2.8.7:*:*:*:*:*:*:*

OR cpe:/a:moodle:moodle:2.8.0:*:*:*:*:*:*:*

OR cpe:/a:moodle:moodle:2.7.9:*:*:*:*:*:*:*

OR cpe:/a:moodle:moodle:2.7.8:*:*:*:*:*:*:*

OR cpe:/a:moodle:moodle:2.7.1:*:*:*:*:*:*:*

OR cpe:/a:moodle:moodle:2.7.0:-:*:*:*:*:*:*

OR cpe:/a:moodle:moodle:2.8.4:*:*:*:*:*:*:*

OR cpe:/a:moodle:moodle:2.8.3:*:*:*:*:*:*:*

OR cpe:/a:moodle:moodle:2.7.5:*:*:*:*:*:*:*

OR cpe:/a:moodle:moodle:2.7.4:*:*:*:*:*:*:*

OR cpe:/a:moodle:moodle:2.9.1:*:*:*:*:*:*:*

OR cpe:/a:moodle:moodle:2.8.2:*:*:*:*:*:*:*

OR cpe:/a:moodle:moodle:2.8.1:*:*:*:*:*:*:*

OR cpe:/a:moodle:moodle:2.7.3:*:*:*:*:*:*:*

OR cpe:/a:moodle:moodle:2.7.2:*:*:*:*:*:*:*

OR cpe:/a:moodle:moodle:2.8.6:*:*:*:*:*:*:*

OR cpe:/a:moodle:moodle:2.8.5:*:*:*:*:*:*:*

OR cpe:/a:moodle:moodle:2.7.7:*:*:*:*:*:*:*

OR cpe:/a:moodle:moodle:2.7.6:*:*:*:*:*:*:*

OR cpe:/a:moodle:moodle:*:*:*:*:*:*:*:* (Version <= 2.6.11)

Configuration CCN 1:

cpe:/a:moodle:moodle:2.7.0:-:*:*:*:*:*:*

OR cpe:/a:moodle:moodle:2.8.0:*:*:*:*:*:*:*

OR cpe:/a:moodle:moodle:2.9.0:*:*:*:*:*:*:*

OR cpe:/a:moodle:moodle:2.8.6:*:*:*:*:*:*:*

OR cpe:/a:moodle:moodle:2.7.8:*:*:*:*:*:*:*

Denotes that component is vulnerable

Oval Definitions

Definition ID	Class	Title	Last Modified
oval:com.ubuntu.bionic:def:201532750000000	V	CVE-2015-3275 on Ubuntu 18.04 LTS (bionic) - medium.	2016-02-22
oval:com.ubuntu.artful:def:20153275000	V	CVE-2015-3275 on Ubuntu 17.10 (artful) - medium.	2016-02-22
oval:com.ubuntu.trusty:def:20153275000	V	CVE-2015-3275 on Ubuntu 14.04 LTS (trusty) - medium.	2016-02-22
oval:com.ubuntu.xenial:def:201532750000000	V	CVE-2015-3275 on Ubuntu 16.04 LTS (xenial) - medium.	2016-02-22
oval:com.ubuntu.bionic:def:20153275000	V	CVE-2015-3275 on Ubuntu 18.04 LTS (bionic) - medium.	2016-02-22
oval:com.ubuntu.xenial:def:20153275000	V	CVE-2015-3275 on Ubuntu 16.04 LTS (xenial) - medium.	2016-02-22
oval:com.ubuntu.disco:def:201532750000000	V	CVE-2015-3275 on Ubuntu 19.04 (disco) - medium.	2016-02-22
oval:com.ubuntu.cosmic:def:20153275000	V	CVE-2015-3275 on Ubuntu 18.10 (cosmic) - medium.	2016-02-22
oval:com.ubuntu.cosmic:def:201532750000000	V	CVE-2015-3275 on Ubuntu 18.10 (cosmic) - medium.	2016-02-22
oval:com.ubuntu.precise:def:20153275000	V	CVE-2015-3275 on Ubuntu 12.04 LTS (precise) - medium.	2016-02-22

BACK