{"id":"CVE-2015-0213","aliases":["EUVD-2022-4163","GHSA-hhq7-jf2p-hw9c","MGASA-2015-0032","UBUNTU-CVE-2015-0213"],"status":"published","title":"Moodle multiple cross-site request forgery (CSRF) vulnerabilities","description":"Multiple cross-site request forgery (CSRF) vulnerabilities in (1) editcategories.html and (2) editcategories.php in the Glossary module in Moodle through 2.5.9, 2.6.x before 2.6.7, 2.7.x before 2.7.4, and 2.8.x before 2.8.2 allow remote attackers to hijack the authentication of unspecified victims.","severity":{"version":"2.0","score":6.8,"vector":"AV:N/AC:M/Au:N/C:P/I:P/A:P","level":"medium","assessor":"primary","from":"nvd"},"epss":{"day":"2026-11-08","score":0.01006,"percentile":0.63245,"model":"v2026.06.15"},"facts":{"in_kev":false,"known_exploited":false,"public_exploit":false,"fix_available":true},"cwes":["CWE-352"],"published":"2015-01-20T14:57:33Z","modified":"2026-06-17T00:19:44Z","fixes":[{"ecosystem":"Packagist","package":"moodle/moodle","fixed_in":["2.6.7","2.7.4","2.8.2"],"sources":["ghsa","osv"]}],"affected":[{"source":"ghsa","ecosystem":"Packagist","package":"moodle/moodle","ranges":[{"type":"ECOSYSTEM","events":[{"introduced":"0"},{"fixed":"2.6.7"}]}]},{"source":"ghsa","ecosystem":"Packagist","package":"moodle/moodle","ranges":[{"type":"ECOSYSTEM","events":[{"introduced":"2.7.0"},{"fixed":"2.7.4"}]}]},{"source":"ghsa","ecosystem":"Packagist","package":"moodle/moodle","ranges":[{"type":"ECOSYSTEM","events":[{"introduced":"2.8.0"},{"fixed":"2.8.2"}]}]},{"source":"osv","ecosystem":"Packagist","package":"moodle/moodle","ranges":[{"type":"ECOSYSTEM","events":[{"introduced":"0"},{"fixed":"2.6.7"}]}],"versions":["v2.3.10","v2.3.11","v2.3.4","v2.3.5","v2.3.6","v2.3.7","v2.3.8","v2.3.9","v2.4.0","v2.4.0-rc1","v2.4.1","v2.4.10","v2.4.11","v2.4.2","v2.4.3","v2.4.4","v2.4.5","v2.4.6","v2.4.7","v2.4.8","v2.4.9","v2.5.0","v2.5.0-beta","v2.5.0-rc1","v2.5.1","v2.5.2","v2.5.3","v2.5.4","v2.5.5","v2.5.6","v2.5.7","v2.5.8","v2.5.9","v2.6.0","v2.6.0-beta","v2.6.0-rc1","v2.6.1","v2.6.2","v2.6.3","v2.6.4","v2.6.5","v2.6.6"]},{"source":"osv","ecosystem":"Packagist","package":"moodle/moodle","ranges":[{"type":"ECOSYSTEM","events":[{"introduced":"2.7.0"},{"fixed":"2.7.4"}]}],"versions":["v2.7.0","v2.7.1","v2.7.2","v2.7.3"]},{"source":"osv","ecosystem":"Packagist","package":"moodle/moodle","ranges":[{"type":"ECOSYSTEM","events":[{"introduced":"2.8.0"},{"fixed":"2.8.2"}]}],"versions":["v2.8.0","v2.8.1"]},{"source":"osv","ecosystem":"Mageia:4","package":"moodle","ranges":[{"type":"ECOSYSTEM","events":[{"introduced":"0"},{"fixed":"2.6.7-1.mga4"}]}],"bundled":7}],"products":[{"vendor":"moodle","product":"moodle"}],"references":[{"url":"http://git.moodle.org/gw?p=moodle.git\u0026a=search\u0026h=HEAD\u0026st=commit\u0026s=MDL-48106","tags":["x_refsource_CONFIRM","x_transferred","web"]},{"url":"http://openwall.com/lists/oss-security/2015/01/19/1","tags":["mailing-list","x_refsource_MLIST","x_transferred","web"]},{"url":"https://moodle.org/mod/forum/discuss.php?d=278613","tags":["x_refsource_CONFIRM","x_transferred","Vendor Advisory","web"]},{"url":"https://nvd.nist.gov/vuln/detail/CVE-2015-0213","tags":["advisory"]},{"url":"https://github.com/moodle/moodle/commit/5770e5147838aa06a3ecdff6fc3aebbbd17fff90","tags":["web"]},{"url":"https://github.com/moodle/moodle/commit/c4250ef4f23776ff4862d2860b6be2cf7b2d85f6","tags":["web"]},{"url":"https://github.com/moodle/moodle/commit/e83c756f84e16ab70e160e08deb84e9bc4bfbfea","tags":["web"]},{"url":"https://github.com/advisories/GHSA-hhq7-jf2p-hw9c"},{"url":"https://github.com/moodle/moodle","tags":["package"]},{"url":"https://advisories.mageia.org/MGASA-2015-0032.html","tags":["advisory"]},{"url":"https://bugs.mageia.org/show_bug.cgi?id=15084","tags":["report"]},{"url":"https://moodle.org/mod/forum/discuss.php?d=278611","tags":["web"]},{"url":"https://moodle.org/mod/forum/discuss.php?d=278612","tags":["web"]},{"url":"https://moodle.org/mod/forum/discuss.php?d=278614","tags":["web"]},{"url":"https://moodle.org/mod/forum/discuss.php?d=278615","tags":["web"]},{"url":"https://moodle.org/mod/forum/discuss.php?d=278617","tags":["web"]},{"url":"https://moodle.org/mod/forum/discuss.php?d=278618","tags":["web"]},{"url":"https://docs.moodle.org/dev/Moodle_2.6.7_release_notes","tags":["web"]},{"url":"https://moodle.org/mod/forum/discuss.php?d=278176","tags":["web"]},{"url":"https://ubuntu.com/security/CVE-2015-0213","tags":["report"]},{"url":"https://moodle.org/mod/forum/discuss.php?d=278613#p1196679","tags":["report"]},{"url":"http://www.openwall.com/lists/oss-security/2015/01/19/1","tags":["report"]},{"url":"https://www.cve.org/CVERecord?id=CVE-2015-0213","tags":["report"]}],"sources":{"cve":[{"id":"CVE-2015-0213","description":"Multiple cross-site request forgery (CSRF) vulnerabilities in (1) editcategories.html and (2) editcategories.php in the Glossary module in Moodle through 2.5.9, 2.6.x before 2.6.7, 2.7.x before 2.7.4, and 2.8.x before 2.8.2 allow remote attackers to hijack the authentication of unspecified victims.","status":"published","published":"2015-06-01T19:00:00Z","modified":"2024-08-06T04:03:10.393Z","updated_at":"2026-11-02T14:35:45.088047Z"}],"euvd":[{"id":"EUVD-2022-4163","description":"Multiple cross-site request forgery (CSRF) vulnerabilities in (1) editcategories.html and (2) editcategories.php in the Glossary module in Moodle through 2.5.9, 2.6.x before 2.6.7, 2.7.x before 2.7.4, and 2.8.x before 2.8.2 allow remote attackers to hijack the authentication of unspecified victims.","status":"published","published":"2015-06-01T19:00:00Z","modified":"2024-08-06T04:03:10Z","updated_at":"2026-11-03T02:22:20.481932Z"}],"ghsa":[{"id":"GHSA-hhq7-jf2p-hw9c","title":"Moodle multiple cross-site request forgery (CSRF) vulnerabilities","description":"Multiple cross-site request forgery (CSRF) vulnerabilities in (1) editcategories.html and (2) editcategories.php in the Glossary module in Moodle through 2.5.9, 2.6.x before 2.6.7, 2.7.x before 2.7.4, and 2.8.x before 2.8.2 allow remote attackers to hijack the authentication of unspecified victims.","status":"published","published":"2022-05-13T01:12:43Z","modified":"2024-01-25T20:34:15Z","cwes":["CWE-352"],"updated_at":"2026-11-02T14:37:32.302254Z"}],"nvd":[{"id":"CVE-2015-0213","description":"Multiple cross-site request forgery (CSRF) vulnerabilities in (1) editcategories.html and (2) editcategories.php in the Glossary module in Moodle through 2.5.9, 2.6.x before 2.6.7, 2.7.x before 2.7.4, and 2.8.x before 2.8.2 allow remote attackers to hijack the authentication of unspecified victims.","status":"published","published":"2015-06-01T19:59:02.837Z","modified":"2026-06-17T00:19:44.53Z","cvss":[{"version":"2.0","score":6.8,"vector":"AV:N/AC:M/Au:N/C:P/I:P/A:P","level":"medium","assessor":"primary"}],"cwes":["CWE-352"],"updated_at":"2026-11-02T14:03:04.906059Z"}],"osv":[{"id":"GHSA-hhq7-jf2p-hw9c","title":"Moodle multiple cross-site request forgery (CSRF) vulnerabilities","description":"Multiple cross-site request forgery (CSRF) vulnerabilities in (1) editcategories.html and (2) editcategories.php in the Glossary module in Moodle through 2.5.9, 2.6.x before 2.6.7, 2.7.x before 2.7.4, and 2.8.x before 2.8.2 allow remote attackers to hijack the authentication of unspecified victims.","status":"published","published":"2022-05-13T01:12:43Z","modified":"2024-12-08T05:39:40.676132Z","cwes":["CWE-352"],"updated_at":"2026-11-02T15:46:49.28217Z"},{"id":"MGASA-2015-0032","title":"Updated moodle package fixes security vulnerabilities","description":"Updated moodle package fixes security vulnerabilities:\n\nIn Moodle before 2.6.7, absence of a capability check in AJAX backend script\nin the LTI module could allow any enrolled user to search the list of\nregistered tools (CVE-2015-0211).\n\nIn Moodle before 2.6.7, the course summary on course request pending approval\npage was displayed to the manager unescaped and could be used for XSS attack\n(CVE-2015-0212).\n\nIn Moodle before 2.6.7, two files in the Glossary module lacked a session key\ncheck potentially allowing cross-site request forgery (CVE-2015-0213).\n\nIn Moodle before 2.6.7, through web-services it was possible to access\nmessaging-related functions such as people search even if messaging is\ndisabled on the site (CVE-2015-0214).\n\nIn Moodle before 2.6.7, through web-services it was possible to get\ninformation about calendar events which user did not have enough permissions\nto see (CVE-2015-0215).\n\nIn Moodle before 2.6.7, non-optimal regular expression in the multimedia\nfilter could be exploited to create extra server load or make particular page\nunavailable, resulting in a denial of service (CVE-2015-0217).\n\nIn Moodle before 2.6.7, it was possible to forge a request to logout users\neven when not authenticated through Shibboleth (CVE-2015-0218).\n","status":"published","published":"2015-01-20T14:57:33Z","modified":"2026-04-16T06:23:43.540798891Z","updated_at":"2026-11-02T15:49:39.488462Z"},{"id":"UBUNTU-CVE-2015-0213","description":"Multiple cross-site request forgery (CSRF) vulnerabilities in (1) editcategories.html and (2) editcategories.php in the Glossary module in Moodle through 2.5.9, 2.6.x before 2.6.7, 2.7.x before 2.7.4, and 2.8.x before 2.8.2 allow remote attackers to hijack the authentication of unspecified victims.","status":"withdrawn","published":"2015-06-01T19:59:00Z","modified":"2025-07-16T07:32:25.64246Z","updated_at":"2026-11-02T15:54:09.721803Z"}]}}