CVE-2015-3274
Moodle cross-site scripting (XSS) vulnerability
Cross-site scripting (XSS) vulnerability in the user_get_user_details function in user/lib.php in Moodle through 2.6.11, 2.7.x before 2.7.9, 2.8.x before 2.8.7, and 2.9.x before 2.9.1 allows remote attackers to inject arbitrary web script or HTML by leveraging absence of an external_format_text call in a web service.
Attack profile
How easy it is to exploit
- Attack vector
- Network
- Complexity
- Low
- Privileges needed
- None
- User interaction
- Required
What an attacker can affect
- Confidentiality
- Low
- Integrity
- Low
- Availability
- None
Exploit likelihood
What each source reports
NVD Score used
Cross-site scripting (XSS) vulnerability in the user_get_user_details function in user/lib.php in Moodle through 2.6.11, 2.7.x before 2.7.9, 2.8.x before 2.8.7, and 2.9.x before 2.9.1 allows remote attackers to inject arbitrary web script or HTML by leveraging absence of an external_format_text call in a web service.
- Record
CVE-2015-3274- CVSS 3.0
- 6.1 Medium
CVSS:3.0/AV:N/AC:L/PR:N/UI:R/S:C/C:L/I:L/A:N - CVSS 2.0
- 4.3 Medium
AV:N/AC:M/Au:N/C:N/I:P/A:N - Weakness
- CWE-79
- Updated
- 2026-11-02
CVE List No score
Cross-site scripting (XSS) vulnerability in the user_get_user_details function in user/lib.php in Moodle through 2.6.11, 2.7.x before 2.7.9, 2.8.x before 2.8.7, and 2.9.x before 2.9.1 allows remote attackers to inject arbitrary web script or HTML by leveraging absence of an external_format_text call in a web service.
- Record
CVE-2015-3274- Updated
- 2026-11-02
EUVDEUVD-2022-3719 No score
Cross-site scripting (XSS) vulnerability in the user_get_user_details function in user/lib.php in Moodle through 2.6.11, 2.7.x before 2.7.9, 2.8.x before 2.8.7, and 2.9.x before 2.9.1 allows remote attackers to inject arbitrary web script or HTML by leveraging absence of an external_format_text call in a web service.
- Record
EUVD-2022-3719- Updated
- 2026-11-03
GitHub AdvisoriesGHSA-f7qm-q26p-6rr2
Moodle cross-site scripting (XSS) vulnerability
Cross-site scripting (XSS) vulnerability in the user_get_user_details function in user/lib.php in Moodle through 2.6.11, 2.7.x before 2.7.9, 2.8.x before 2.8.7, and 2.9.x before 2.9.1 allows remote attackers to inject arbitrary web script or HTML by leveraging absence of an external_format_text call in a web service.
- Record
GHSA-f7qm-q26p-6rr2- CVSS 3.0
- 6.1 Medium
CVSS:3.0/AV:N/AC:L/PR:N/UI:R/S:C/C:L/I:L/A:N - Weakness
- CWE-79
- Updated
- 2026-11-02
OSVGHSA-f7qm-q26p-6rr2
Moodle cross-site scripting (XSS) vulnerability
Cross-site scripting (XSS) vulnerability in the user_get_user_details function in user/lib.php in Moodle through 2.6.11, 2.7.x before 2.7.9, 2.8.x before 2.8.7, and 2.9.x before 2.9.1 allows remote attackers to inject arbitrary web script or HTML by leveraging absence of an external_format_text call in a web service.
- Record
GHSA-f7qm-q26p-6rr2- CVSS 3.0
- 6.1 Medium
CVSS:3.0/AV:N/AC:L/PR:N/UI:R/S:C/C:L/I:L/A:N - Weakness
- CWE-79
- Updated
- 2026-11-02
OSVUBUNTU-CVE-2015-3274
Cross-site scripting (XSS) vulnerability in the user_get_user_details function in user/lib.php in Moodle through 2.6.11, 2.7.x before 2.7.9, 2.8.x before 2.8.7, and 2.9.x before 2.9.1 allows remote attackers to inject arbitrary web script or HTML by leveraging absence of an external_format_text call in a web service.
- Record
UBUNTU-CVE-2015-3274- CVSS 3.0
- 6.1 Medium
CVSS:3.0/AV:N/AC:L/PR:N/UI:R/S:C/C:L/I:L/A:N - Updated
- 2026-11-02
OSVMGASA-2015-0302 No score
Updated moodle package fixes security vulnerabilities
In Moodle before 2.8.7, phishing is possible when redirecting to external site using referer headers in error messages (CVE-2015-3272).
In Moodle before 2.8.7, several web services returning user information did not clean text in text custom profile fields, leading to possible XSS (CVE-2015-3274).
In Moodle before 2.8.7, possible Javascript injection was discovered in the SCORM module (CVE-2015-3275).
As Moodle 2.6 is no longer supported, users of this package on Mageia 4 are advised to migrate to Mageia 5.
- Record
MGASA-2015-0302- Updated
- 2026-11-02
Affected products
Affected packages
| Package | Affected | Fixed |
|---|---|---|
moodle/moodlePackagist |
2.7.0 up to 2.7.9 | 2.7.9 |
moodle/moodlePackagist |
2.8.0 up to 2.8.7 | 2.8.7 |
moodle/moodlePackagist |
2.9.0 up to 2.9.1 | 2.9.1 |
moodle/moodlePackagist |
2.7.0 up to 2.7.9, plus listed versions v2.7.0v2.7.1v2.7.2v2.7.3v2.7.4 Show 4 moreShow lessv2.7.5v2.7.6v2.7.7v2.7.8 |
2.7.9 |
moodle/moodlePackagist |
2.8.0 up to 2.8.7, plus listed versions v2.8.0v2.8.1v2.8.2v2.8.3v2.8.4v2.8.5v2.8.6 |
2.8.7 |
moodle/moodlePackagist |
2.9.0 up to 2.9.1, plus listed versions v2.9.0 |
2.9.1 |
moodleMageia:5 |
before 2.8.7-1.mga5 | 2.8.7-1.mga5 |
History
| Recorded | Changed | Sources |
|---|---|---|
| affected | ||
| aliases | EUVD | |
| first indexed | CVE List, GitHub Advisories, NVD, OSV |
Dates are when Every CVE recorded each change. Upstream dates may differ.
In short
CVE-2015-3274 is a medium vulnerability (CVSS 6.1) in Moodle, published August 3, 2015. No source lists public exploit code. EPSS puts the chance of exploitation in the next 30 days at 1.47%, the 73rd percentile. Fixed in moodle/moodle 2.7.9.
References
openwall.com/lists/oss-security/2015/07/13/2
git.moodle.org/gw?p=moodle.git&a=search&h=HEAD&st=commit&s=MDL-50130
securitytracker.com/id/1032877
moodle.org/mod/forum/discuss.php?d=316664
nvd.nist.gov/vuln/detail/CVE-2015-3274
github.com/moodle/moodle/commit/7b15a363201109354bbd6d51a7c70f50dac7b9d8
Show 14 moreShow less
web.archive.org/web/20150924032214/http://www.securitytracker.com/id/1032877
advisories.mageia.org/MGASA-2015-0302.html
bugs.mageia.org/show_bug.cgi?id=16374
docs.moodle.org/dev/Moodle_2.8.7_release_notes
ubuntu.com/security/CVE-2015-3274
cve.org/CVERecord?id=CVE-2015-3274