{"id":"CVE-2015-3179","aliases":["EUVD-2022-2418","GHSA-4ppg-2mx6-fqx9","MGASA-2015-0229","UBUNTU-CVE-2015-3179"],"status":"published","title":"Moodle allows attackers to bypass intended login restrictions","description":"login/confirm.php in Moodle through 2.5.9, 2.6.x before 2.6.11, 2.7.x before 2.7.8, and 2.8.x before 2.8.6 allows remote authenticated users to bypass intended login restrictions by leveraging access to an unconfirmed suspended account.","severity":{"version":"2.0","score":3.5,"vector":"AV:N/AC:M/Au:S/C:N/I:P/A:N","level":"low","assessor":"primary","from":"nvd"},"epss":{"day":"2026-11-07","score":0.01524,"percentile":0.74798,"model":"v2026.06.15"},"facts":{"in_kev":false,"known_exploited":false,"public_exploit":false,"fix_available":true},"cwes":["CWE-264"],"published":"2015-05-18T19:08:05Z","modified":"2026-06-17T00:25:28Z","fixes":[{"ecosystem":"Packagist","package":"moodle/moodle","fixed_in":["2.6.11","2.7.8","2.8.6"],"sources":["ghsa","osv"]}],"affected":[{"source":"ghsa","ecosystem":"Packagist","package":"moodle/moodle","ranges":[{"type":"ECOSYSTEM","events":[{"introduced":"0"},{"fixed":"2.6.11"}]}]},{"source":"ghsa","ecosystem":"Packagist","package":"moodle/moodle","ranges":[{"type":"ECOSYSTEM","events":[{"introduced":"2.7.0"},{"fixed":"2.7.8"}]}]},{"source":"ghsa","ecosystem":"Packagist","package":"moodle/moodle","ranges":[{"type":"ECOSYSTEM","events":[{"introduced":"2.8.0"},{"fixed":"2.8.6"}]}]},{"source":"osv","ecosystem":"Packagist","package":"moodle/moodle","ranges":[{"type":"ECOSYSTEM","events":[{"introduced":"0"},{"fixed":"2.6.11"}]}],"versions":["v2.3.10","v2.3.11","v2.3.4","v2.3.5","v2.3.6","v2.3.7","v2.3.8","v2.3.9","v2.4.0","v2.4.0-rc1","v2.4.1","v2.4.10","v2.4.11","v2.4.2","v2.4.3","v2.4.4","v2.4.5","v2.4.6","v2.4.7","v2.4.8","v2.4.9","v2.5.0","v2.5.0-beta","v2.5.0-rc1","v2.5.1","v2.5.2","v2.5.3","v2.5.4","v2.5.5","v2.5.6","v2.5.7","v2.5.8","v2.5.9","v2.6.0","v2.6.0-beta","v2.6.0-rc1","v2.6.1","v2.6.10","v2.6.2","v2.6.3","v2.6.4","v2.6.5","v2.6.6","v2.6.7","v2.6.8","v2.6.9"]},{"source":"osv","ecosystem":"Packagist","package":"moodle/moodle","ranges":[{"type":"ECOSYSTEM","events":[{"introduced":"2.7.0"},{"fixed":"2.7.8"}]}],"versions":["v2.7.0","v2.7.1","v2.7.2","v2.7.3","v2.7.4","v2.7.5","v2.7.6","v2.7.7"]},{"source":"osv","ecosystem":"Packagist","package":"moodle/moodle","ranges":[{"type":"ECOSYSTEM","events":[{"introduced":"2.8.0"},{"fixed":"2.8.6"}]}],"versions":["v2.8.0","v2.8.1","v2.8.2","v2.8.3","v2.8.4","v2.8.5"]},{"source":"osv","ecosystem":"Mageia:4","package":"moodle","ranges":[{"type":"ECOSYSTEM","events":[{"introduced":"0"},{"fixed":"2.6.11-1.mga4"}]}],"bundled":7}],"products":[{"vendor":"moodle","product":"moodle"}],"references":[{"url":"http://www.securityfocus.com/bid/74725","tags":["vdb-entry","x_refsource_BID","x_transferred"]},{"url":"https://moodle.org/mod/forum/discuss.php?d=313686","tags":["x_refsource_CONFIRM","x_transferred","Vendor Advisory","web","report"]},{"url":"http://www.securitytracker.com/id/1032358","tags":["vdb-entry","x_refsource_SECTRACK","x_transferred"]},{"url":"http://openwall.com/lists/oss-security/2015/05/18/1","tags":["mailing-list","x_refsource_MLIST","x_transferred","web"]},{"url":"http://git.moodle.org/gw?p=moodle.git\u0026a=search\u0026h=HEAD\u0026st=commit\u0026s=MDL-50090","tags":["x_refsource_CONFIRM","x_transferred","web"]},{"url":"https://nvd.nist.gov/vuln/detail/CVE-2015-3179","tags":["advisory"]},{"url":"https://github.com/moodle/moodle/commit/78ec6751fc57bb17bb67c26870fea396390b9937","tags":["web"]},{"url":"https://github.com/moodle/moodle/commit/811ae9f082697495248c6c87ec80aeaf88c851fc","tags":["web"]},{"url":"https://github.com/moodle/moodle/commit/98c38993fd6cbd78bf5819c68c55fcfded6467c0","tags":["web"]},{"url":"https://github.com/moodle/moodle/commit/f236dcc35c3595dfcc77932d84660056e982a310","tags":["web"]},{"url":"https://web.archive.org/web/20200228054915/http://www.securityfocus.com/bid/74725","tags":["web"]},{"url":"https://web.archive.org/web/20200501000000*/http://www.securitytracker.com/id/1032358","tags":["web"]},{"url":"https://github.com/advisories/GHSA-4ppg-2mx6-fqx9"},{"url":"https://github.com/moodle/moodle","tags":["package"]},{"url":"https://advisories.mageia.org/MGASA-2015-0229.html","tags":["advisory"]},{"url":"https://bugs.mageia.org/show_bug.cgi?id=15909","tags":["report"]},{"url":"https://moodle.org/mod/forum/discuss.php?d=313681","tags":["web"]},{"url":"https://moodle.org/mod/forum/discuss.php?d=313682","tags":["web"]},{"url":"https://moodle.org/mod/forum/discuss.php?d=313683","tags":["web"]},{"url":"https://moodle.org/mod/forum/discuss.php?d=313685","tags":["web"]},{"url":"https://moodle.org/mod/forum/discuss.php?d=313687","tags":["web"]},{"url":"https://moodle.org/mod/forum/discuss.php?d=313688","tags":["web"]},{"url":"https://docs.moodle.org/dev/Moodle_2.6.11_release_notes","tags":["web"]},{"url":"https://moodle.org/mod/forum/discuss.php?d=313322","tags":["web"]},{"url":"https://ubuntu.com/security/CVE-2015-3179","tags":["report"]},{"url":"http://www.openwall.com/lists/oss-security/2015/05/18/1","tags":["report"]},{"url":"https://www.cve.org/CVERecord?id=CVE-2015-3179","tags":["report"]}],"sources":{"cve":[{"id":"CVE-2015-3179","description":"login/confirm.php in Moodle through 2.5.9, 2.6.x before 2.6.11, 2.7.x before 2.7.8, and 2.8.x before 2.8.6 allows remote authenticated users to bypass intended login restrictions by leveraging access to an unconfirmed suspended account.","status":"published","published":"2015-06-01T19:00:00Z","modified":"2024-08-06T05:39:31.951Z","updated_at":"2026-11-02T14:35:41.976732Z"}],"euvd":[{"id":"EUVD-2022-2418","description":"login/confirm.php in Moodle through 2.5.9, 2.6.x before 2.6.11, 2.7.x before 2.7.8, and 2.8.x before 2.8.6 allows remote authenticated users to bypass intended login restrictions by leveraging access to an unconfirmed suspended account.","status":"published","published":"2015-06-01T19:00:00Z","modified":"2024-08-06T05:39:31Z","updated_at":"2026-11-03T02:22:09.179399Z"}],"ghsa":[{"id":"GHSA-4ppg-2mx6-fqx9","title":"Moodle allows attackers to bypass intended login restrictions","description":"login/confirm.php in Moodle through 2.5.9, 2.6.x before 2.6.11, 2.7.x before 2.7.8, and 2.8.x before 2.8.6 allows remote authenticated users to bypass intended login restrictions by leveraging access to an unconfirmed suspended account.","status":"published","published":"2022-05-13T01:12:45Z","modified":"2024-01-26T01:10:54Z","updated_at":"2026-11-02T14:37:33.019154Z"}],"nvd":[{"id":"CVE-2015-3179","description":"login/confirm.php in Moodle through 2.5.9, 2.6.x before 2.6.11, 2.7.x before 2.7.8, and 2.8.x before 2.8.6 allows remote authenticated users to bypass intended login restrictions by leveraging access to an unconfirmed suspended account.","status":"published","published":"2015-06-01T19:59:22.087Z","modified":"2026-06-17T00:25:28.487Z","cvss":[{"version":"2.0","score":3.5,"vector":"AV:N/AC:M/Au:S/C:N/I:P/A:N","level":"low","assessor":"primary"}],"cwes":["CWE-264"],"updated_at":"2026-11-02T14:03:04.906059Z"}],"osv":[{"id":"GHSA-4ppg-2mx6-fqx9","title":"Moodle allows attackers to bypass intended login restrictions","description":"login/confirm.php in Moodle through 2.5.9, 2.6.x before 2.6.11, 2.7.x before 2.7.8, and 2.8.x before 2.8.6 allows remote authenticated users to bypass intended login restrictions by leveraging access to an unconfirmed suspended account.","status":"published","published":"2022-05-13T01:12:45Z","modified":"2024-12-08T05:31:25.29313Z","updated_at":"2026-11-02T15:46:37.148947Z"},{"id":"MGASA-2015-0229","title":"Updated moodle packages fix security vulnerabilities","description":"Updated moodle package fixes security vulnerabilities:\n\nIn Moodle before 2.6.11, leaving gradebook feedback is a trusted action and\nsuch capabilities in other modules already have an XSS mask, 'mod/quiz:grade'\nwas missing this flag (CVE-2015-3174).\n\nIn Moodle before 2.6.11, some error messages display a button to return to\nthe previous page. Redirecting to non-local referer should not be allowed as\nit can potentially be used for phising (CVE-2015-3175).\n\nIn Moodle before 2.6.11, on sites with enabled self-registration, not\nregistered users can retrieve fullname of registered users if they know their\nusernames (CVE-2015-3176).\n\nIn Moodle before 2.6.11, if a user who is not XSS-trusted attempts to insert\na script as part of the input text, it will be cleaned when displayed on the\nMoodle website but may be displayed uncleaned in the external application\nbecause external_format_text() cleans and formats text incorrectly when\nreturning it from Web Services (CVE-2015-3178).\n\nIn Moodle before 2.6.11, when self-registration is enabled and a user's\naccount was suspended after creating the account but before actually\nconfirming it, the user is still able to login when confirming their email,\nbut only once (CVE-2015-3179).\n\nIn Moodle before 2.6.11, if a user is enrolled in the course but his\nenrollment is suspended, they can not access the course but still were able\nto see the course structure in the navigation block (CVE-2015-3180).\n\nIn Moodle before 2.6.11, users with the revoked capability\n'moodle/user:manageownfiles' are still able to upload private files using a\ndeprecated function in Web Services (CVE-2015-3181).\n","status":"published","published":"2015-05-18T19:08:05Z","modified":"2026-04-16T06:23:41.341038785Z","updated_at":"2026-11-02T15:49:39.792687Z"},{"id":"UBUNTU-CVE-2015-3179","description":"login/confirm.php in Moodle through 2.5.9, 2.6.x before 2.6.11, 2.7.x before 2.7.8, and 2.8.x before 2.8.6 allows remote authenticated users to bypass intended login restrictions by leveraging access to an unconfirmed suspended account.","status":"withdrawn","published":"2015-06-01T19:59:00Z","modified":"2025-07-16T07:32:52.738142Z","updated_at":"2026-11-02T15:54:10.045446Z"}]}}