CVE-2015-3274
Moodle cross-site scripting (XSS) vulnerability
CVE-2015-3274 is a medium vulnerability (CVSS 6.1) in Moodle, published August 3, 2015. No source lists public exploit code. EPSS puts the chance of exploitation in the next 30 days at 1.47%, the 74th percentile. Fixed in moodle/moodle 2.7.9.
- Severity
- 6.1 MediumCVSS 3.0, NVD
- Exploit chance
- 1.47%EPSS, 74th percentile
- Exploitation
- None knownNot on CISA’s or ENISA’s lists
- Fixed in
2.7.9moodle/moodle +6 more
Description
Cross-site scripting (XSS) vulnerability in the user_get_user_details function in user/lib.php in Moodle through 2.6.11, 2.7.x before 2.7.9, 2.8.x before 2.8.7, and 2.9.x before 2.9.1 allows remote attackers to inject arbitrary web script or HTML by leveraging absence of an external_format_text call in a web service.
Attack profile
How easy it is to exploit
- Attack vector
- Network
- Complexity
- Low
- Privileges needed
- None
- User interaction
- Required
What an attacker can affect
- Confidentiality
- Low
- Integrity
- Low
- Availability
- None
Exploit likelihood
Affected products
Affected packages
| Package | Affected | Fixed |
|---|---|---|
moodle/moodlePackagist | 2.7.0 up to 2.7.9 | 2.7.9 |
moodle/moodlePackagist | 2.8.0 up to 2.8.7 | 2.8.7 |
moodle/moodlePackagist | 2.9.0 up to 2.9.1 | 2.9.1 |
moodle/moodlePackagist | 2.7.0 up to 2.7.9, plus listed versions v2.7.0v2.7.1v2.7.2v2.7.3v2.7.4 Show 4 moreShow lessv2.7.5v2.7.6v2.7.7v2.7.8 | 2.7.9 |
moodle/moodlePackagist | 2.8.0 up to 2.8.7, plus listed versions v2.8.0v2.8.1v2.8.2v2.8.3v2.8.4v2.8.5v2.8.6 | 2.8.7 |
moodle/moodlePackagist | 2.9.0 up to 2.9.1, plus listed versions v2.9.0 | 2.9.1 |
moodleMageia:5 From an advisory covering 3 CVEs | before 2.8.7-1.mga5 | 2.8.7-1.mga5 |
What each source reports
NVD Score used
Cross-site scripting (XSS) vulnerability in the user_get_user_details function in user/lib.php in Moodle through 2.6.11, 2.7.x before 2.7.9, 2.8.x before 2.8.7, and 2.9.x before 2.9.1 allows remote attackers to inject arbitrary web script or HTML by leveraging absence of an external_format_text call in a web service.
- Record
CVE-2015-3274- CVSS 3.0
- 6.1 Medium
CVSS:3.0/AV:N/AC:L/PR:N/UI:R/S:C/C:L/I:L/A:N - CVSS 2.0
- 4.3 Medium
AV:N/AC:M/Au:N/C:N/I:P/A:N - Weakness
- CWE-79
- Updated
- 2026-11-02
CVE ListNo score
Cross-site scripting (XSS) vulnerability in the user_get_user_details function in user/lib.php in Moodle through 2.6.11, 2.7.x before 2.7.9, 2.8.x before 2.8.7, and 2.9.x before 2.9.1 allows remote attackers to inject arbitrary web script or HTML by leveraging absence of an external_format_text call in a web service.
- Record
CVE-2015-3274- Updated
- 2026-11-02
EUVDEUVD-2022-3719No score
Cross-site scripting (XSS) vulnerability in the user_get_user_details function in user/lib.php in Moodle through 2.6.11, 2.7.x before 2.7.9, 2.8.x before 2.8.7, and 2.9.x before 2.9.1 allows remote attackers to inject arbitrary web script or HTML by leveraging absence of an external_format_text call in a web service.
- Record
EUVD-2022-3719- Updated
- 2026-11-03
GitHub AdvisoriesGHSA-f7qm-q26p-6rr2
Moodle cross-site scripting (XSS) vulnerability
Cross-site scripting (XSS) vulnerability in the user_get_user_details function in user/lib.php in Moodle through 2.6.11, 2.7.x before 2.7.9, 2.8.x before 2.8.7, and 2.9.x before 2.9.1 allows remote attackers to inject arbitrary web script or HTML by leveraging absence of an external_format_text call in a web service.
- Record
GHSA-f7qm-q26p-6rr2- CVSS 3.0
- 6.1 Medium
CVSS:3.0/AV:N/AC:L/PR:N/UI:R/S:C/C:L/I:L/A:N - Weakness
- CWE-79
- Updated
- 2026-11-02
OSVGHSA-f7qm-q26p-6rr2
Moodle cross-site scripting (XSS) vulnerability
Cross-site scripting (XSS) vulnerability in the user_get_user_details function in user/lib.php in Moodle through 2.6.11, 2.7.x before 2.7.9, 2.8.x before 2.8.7, and 2.9.x before 2.9.1 allows remote attackers to inject arbitrary web script or HTML by leveraging absence of an external_format_text call in a web service.
- Record
GHSA-f7qm-q26p-6rr2- CVSS 3.0
- 6.1 Medium
CVSS:3.0/AV:N/AC:L/PR:N/UI:R/S:C/C:L/I:L/A:N - Weakness
- CWE-79
- Updated
- 2026-11-02
OSVUBUNTU-CVE-2015-3274
Cross-site scripting (XSS) vulnerability in the user_get_user_details function in user/lib.php in Moodle through 2.6.11, 2.7.x before 2.7.9, 2.8.x before 2.8.7, and 2.9.x before 2.9.1 allows remote attackers to inject arbitrary web script or HTML by leveraging absence of an external_format_text call in a web service.
- Record
UBUNTU-CVE-2015-3274- CVSS 3.0
- 6.1 Medium
CVSS:3.0/AV:N/AC:L/PR:N/UI:R/S:C/C:L/I:L/A:N - Updated
- 2026-11-02
OSVMGASA-2015-0302No score
Updated moodle package fixes security vulnerabilities
In Moodle before 2.8.7, phishing is possible when redirecting to external site using referer headers in error messages (CVE-2015-3272).
In Moodle before 2.8.7, several web services returning user information did not clean text in text custom profile fields, leading to possible XSS (CVE-2015-3274).
In Moodle before 2.8.7, possible Javascript injection was discovered in the SCORM module (CVE-2015-3275).
As Moodle 2.6 is no longer supported, users of this package on Mageia 4 are advised to migrate to Mageia 5.
- Record
MGASA-2015-0302- Updated
- 2026-11-02
History
| Recorded | Changed | Sources |
|---|---|---|
| affected, facts | ||
| affected | ||
| aliases | EUVD | |
| first indexed | CVE List, GitHub Advisories, NVD, OSV |
Dates are when Every CVE recorded each change. Upstream dates may differ.
References
openwall.com/lists/oss-security/2015/07/13/2
git.moodle.org/gw?p=moodle.git&a=search&h=HEAD&st=commit&s=MDL-50130
securitytracker.com/id/1032877
moodle.org/mod/forum/discuss.php?d=316664
nvd.nist.gov/vuln/detail/CVE-2015-3274
github.com/moodle/moodle/commit/7b15a363201109354bbd6d51a7c70f50dac7b9d8
Show 14 moreShow less
web.archive.org/web/20150924032214/http://www.securitytracker.com/id/1032877
advisories.mageia.org/MGASA-2015-0302.html
bugs.mageia.org/show_bug.cgi?id=16374
docs.moodle.org/dev/Moodle_2.8.7_release_notes
ubuntu.com/security/CVE-2015-3274
cve.org/CVERecord?id=CVE-2015-3274