{"id":"CVE-2015-5336","aliases":["EUVD-2022-4006","GHSA-grvw-qq2j-r898","MGASA-2015-0464","UBUNTU-CVE-2015-5336"],"status":"published","title":"Moodle multiple cross-site scripting (XSS) vulnerabilities","description":"Multiple cross-site scripting (XSS) vulnerabilities in the survey module in Moodle through 2.6.11, 2.7.x before 2.7.11, 2.8.x before 2.8.9, and 2.9.x before 2.9.3 allow remote authenticated users to inject arbitrary web script or HTML by leveraging the student role and entering a crafted survey answer.","severity":{"version":"3.0","score":5.4,"vector":"CVSS:3.0/AV:N/AC:L/PR:L/UI:R/S:C/C:L/I:L/A:N","level":"medium","assessor":"primary","from":"nvd"},"epss":{"day":"2026-11-07","score":0.0087,"percentile":0.59035,"model":"v2026.06.15"},"facts":{"in_kev":false,"known_exploited":false,"public_exploit":false,"fix_available":true},"cwes":["CWE-79"],"published":"2015-12-05T10:03:58Z","modified":"2026-06-17T00:28:57Z","fixes":[{"ecosystem":"Packagist","package":"moodle/moodle","fixed_in":["2.7.11","2.8.9","2.9.3"],"sources":["ghsa","osv"]}],"affected":[{"source":"ghsa","ecosystem":"Packagist","package":"moodle/moodle","ranges":[{"type":"ECOSYSTEM","events":[{"introduced":"0"},{"fixed":"2.7.11"}]}]},{"source":"ghsa","ecosystem":"Packagist","package":"moodle/moodle","ranges":[{"type":"ECOSYSTEM","events":[{"introduced":"2.8.0"},{"fixed":"2.8.9"}]}]},{"source":"ghsa","ecosystem":"Packagist","package":"moodle/moodle","ranges":[{"type":"ECOSYSTEM","events":[{"introduced":"2.9.0"},{"fixed":"2.9.3"}]}]},{"source":"osv","ecosystem":"Packagist","package":"moodle/moodle","ranges":[{"type":"ECOSYSTEM","events":[{"introduced":"0"},{"fixed":"2.7.11"}]}],"versions":["v2.3.10","v2.3.11","v2.3.4","v2.3.5","v2.3.6","v2.3.7","v2.3.8","v2.3.9","v2.4.0","v2.4.0-rc1","v2.4.1","v2.4.10","v2.4.11","v2.4.2","v2.4.3","v2.4.4","v2.4.5","v2.4.6","v2.4.7","v2.4.8","v2.4.9","v2.5.0","v2.5.0-beta","v2.5.0-rc1","v2.5.1","v2.5.2","v2.5.3","v2.5.4","v2.5.5","v2.5.6","v2.5.7","v2.5.8","v2.5.9","v2.6.0","v2.6.0-beta","v2.6.0-rc1","v2.6.1","v2.6.10","v2.6.11","v2.6.2","v2.6.3","v2.6.4","v2.6.5","v2.6.6","v2.6.7","v2.6.8","v2.6.9","v2.7.0","v2.7.0-beta","v2.7.0-rc1","v2.7.0-rc2","v2.7.1","v2.7.10","v2.7.2","v2.7.3","v2.7.4","v2.7.5","v2.7.6","v2.7.7","v2.7.8","v2.7.9"]},{"source":"osv","ecosystem":"Packagist","package":"moodle/moodle","ranges":[{"type":"ECOSYSTEM","events":[{"introduced":"2.8.0"},{"fixed":"2.8.9"}]}],"versions":["v2.8.0","v2.8.1","v2.8.2","v2.8.3","v2.8.4","v2.8.5","v2.8.6","v2.8.7","v2.8.8"]},{"source":"osv","ecosystem":"Packagist","package":"moodle/moodle","ranges":[{"type":"ECOSYSTEM","events":[{"introduced":"2.9.0"},{"fixed":"2.9.3"}]}],"versions":["v2.9.0","v2.9.1","v2.9.2"]},{"source":"osv","ecosystem":"Mageia:5","package":"moodle","ranges":[{"type":"ECOSYSTEM","events":[{"introduced":"0"},{"fixed":"2.8.9-1.mga5"}]}],"bundled":9}],"products":[{"vendor":"moodle","product":"moodle"}],"references":[{"url":"https://moodle.org/mod/forum/discuss.php?d=323231","tags":["x_refsource_CONFIRM","x_transferred","Vendor Advisory","web"]},{"url":"http://git.moodle.org/gw?p=moodle.git\u0026a=search\u0026h=HEAD\u0026st=commit\u0026s=MDL-49940","tags":["x_refsource_CONFIRM","x_transferred","web"]},{"url":"https://nvd.nist.gov/vuln/detail/CVE-2015-5336","tags":["advisory"]},{"url":"https://github.com/moodle/moodle/commit/12c232df76885effa5ebac08e3094d6db5aa9223","tags":["web"]},{"url":"https://github.com/moodle/moodle/commit/31d0bf81af079bc285ea439ac5160f9e45697c88","tags":["web"]},{"url":"https://github.com/moodle/moodle/commit/48d8989f13a6320c54b05f7d3ea552356cf85ed6","tags":["web"]},{"url":"https://github.com/moodle/moodle/commit/86cec86942c1cfcb92b840afd18deed9b9a34951","tags":["web"]},{"url":"https://github.com/moodle/moodle/commit/b4f4232e1cf76334e4b8dda9cf68962b121e6bc0","tags":["web"]},{"url":"https://github.com/moodle/moodle/commit/f03ec4ce85b3d361429d9f66dbbb478a353640c9","tags":["web"]},{"url":"https://github.com/moodle/moodle/commit/fd14d2902fab15fa6affecc427bb11d3869d9afe","tags":["web"]},{"url":"https://github.com/advisories/GHSA-grvw-qq2j-r898"},{"url":"https://github.com/moodle/moodle","tags":["package"]},{"url":"https://advisories.mageia.org/MGASA-2015-0464.html","tags":["advisory"]},{"url":"https://bugs.mageia.org/show_bug.cgi?id=17280","tags":["report"]},{"url":"https://moodle.org/mod/forum/discuss.php?d=323229","tags":["web"]},{"url":"https://moodle.org/mod/forum/discuss.php?d=323230","tags":["web"]},{"url":"https://moodle.org/mod/forum/discuss.php?d=323232","tags":["web"]},{"url":"https://moodle.org/mod/forum/discuss.php?d=323233","tags":["web"]},{"url":"https://moodle.org/mod/forum/discuss.php?d=323234","tags":["web"]},{"url":"https://moodle.org/mod/forum/discuss.php?d=323235","tags":["web"]},{"url":"https://moodle.org/mod/forum/discuss.php?d=323236","tags":["web"]},{"url":"https://moodle.org/mod/forum/discuss.php?d=323237","tags":["web"]},{"url":"https://docs.moodle.org/dev/Moodle_2.8.9_release_notes","tags":["web"]},{"url":"https://moodle.org/mod/forum/discuss.php?d=322852","tags":["web"]},{"url":"https://ubuntu.com/security/CVE-2015-5336","tags":["report"]},{"url":"https://moodle.org/mod/forum/discuss.php?d=323231#p1297702","tags":["report"]},{"url":"https://www.cve.org/CVERecord?id=CVE-2015-5336","tags":["report"]}],"sources":{"cve":[{"id":"CVE-2015-5336","description":"Multiple cross-site scripting (XSS) vulnerabilities in the survey module in Moodle through 2.6.11, 2.7.x before 2.7.11, 2.8.x before 2.8.9, and 2.9.x before 2.9.3 allow remote authenticated users to inject arbitrary web script or HTML by leveraging the student role and entering a crafted survey answer.","status":"published","published":"2016-02-22T02:00:00Z","modified":"2024-08-06T06:41:09.282Z","updated_at":"2026-11-02T14:35:39.846011Z"}],"euvd":[{"id":"EUVD-2022-4006","description":"Multiple cross-site scripting (XSS) vulnerabilities in the survey module in Moodle through 2.6.11, 2.7.x before 2.7.11, 2.8.x before 2.8.9, and 2.9.x before 2.9.3 allow remote authenticated users to inject arbitrary web script or HTML by leveraging the student role and entering a crafted survey answer.","status":"published","published":"2016-02-22T02:00:00Z","modified":"2024-08-06T06:41:09Z","updated_at":"2026-11-03T02:22:00.305488Z"}],"ghsa":[{"id":"GHSA-grvw-qq2j-r898","title":"Moodle multiple cross-site scripting (XSS) vulnerabilities","description":"Multiple cross-site scripting (XSS) vulnerabilities in the survey module in Moodle through 2.6.11, 2.7.x before 2.7.11, 2.8.x before 2.8.9, and 2.9.x before 2.9.3 allow remote authenticated users to inject arbitrary web script or HTML by leveraging the student role and entering a crafted survey answer.","status":"published","published":"2022-05-13T01:12:47Z","modified":"2024-01-26T20:10:59Z","cvss":[{"version":"3.0","score":5.4,"vector":"CVSS:3.0/AV:N/AC:L/PR:L/UI:R/S:C/C:L/I:L/A:N","level":"medium"}],"cwes":["CWE-79"],"updated_at":"2026-11-02T14:37:33.019154Z"}],"nvd":[{"id":"CVE-2015-5336","description":"Multiple cross-site scripting (XSS) vulnerabilities in the survey module in Moodle through 2.6.11, 2.7.x before 2.7.11, 2.8.x before 2.8.9, and 2.9.x before 2.9.3 allow remote authenticated users to inject arbitrary web script or HTML by leveraging the student role and entering a crafted survey answer.","status":"published","published":"2016-02-22T05:59:14.53Z","modified":"2026-06-17T00:28:57.143Z","cvss":[{"version":"3.0","score":5.4,"vector":"CVSS:3.0/AV:N/AC:L/PR:L/UI:R/S:C/C:L/I:L/A:N","level":"medium","assessor":"primary"},{"version":"2.0","score":3.5,"vector":"AV:N/AC:M/Au:S/C:N/I:P/A:N","level":"low","assessor":"primary"}],"cwes":["CWE-79"],"updated_at":"2026-11-02T14:03:16.97467Z"}],"osv":[{"id":"GHSA-grvw-qq2j-r898","title":"Moodle multiple cross-site scripting (XSS) vulnerabilities","description":"Multiple cross-site scripting (XSS) vulnerabilities in the survey module in Moodle through 2.6.11, 2.7.x before 2.7.11, 2.8.x before 2.8.9, and 2.9.x before 2.9.3 allow remote authenticated users to inject arbitrary web script or HTML by leveraging the student role and entering a crafted survey answer.","status":"published","published":"2022-05-13T01:12:47Z","modified":"2024-02-16T08:01:54.623402Z","cvss":[{"version":"3.0","score":5.4,"vector":"CVSS:3.0/AV:N/AC:L/PR:L/UI:R/S:C/C:L/I:L/A:N","level":"medium"}],"cwes":["CWE-79"],"updated_at":"2026-11-02T15:46:48.191583Z"},{"id":"UBUNTU-CVE-2015-5336","description":"Multiple cross-site scripting (XSS) vulnerabilities in the survey module in Moodle through 2.6.11, 2.7.x before 2.7.11, 2.8.x before 2.8.9, and 2.9.x before 2.9.3 allow remote authenticated users to inject arbitrary web script or HTML by leveraging the student role and entering a crafted survey answer.","status":"withdrawn","published":"2016-02-22T05:59:00Z","modified":"2025-07-16T07:17:34.106124Z","cvss":[{"version":"3.0","score":5.4,"vector":"CVSS:3.0/AV:N/AC:L/PR:L/UI:R/S:C/C:L/I:L/A:N","level":"medium"}],"updated_at":"2026-11-02T15:54:10.385269Z"},{"id":"MGASA-2015-0464","title":"Updated moodle packages fix security vulnerability","description":"In Moodle before 2.8.9, if guest access is open on the site,\nunauthenticated users can store Atto draft data through the editor\nautosave area, which could be exploited in a denial of service attack\n(CVE-2015-5332).\n\nIn Moodle before 2.8.9, due to a CSRF issue in the site registration form,\nit is possible to trick a site admin into sending aggregate stats to an\narbitrary domain. The attacker can send the admin a link to a site\nregistration form that will display the correct URL but, if submitted,\nwill register with another hub (CVE-2015-5335).\n\nIn Moodle before 2.8.9, the standard survey module is vulnerable to XSS\nattack by students who fill the survey (CVE-2015-5336).\n\nIn Moodle before 2.8.9, there was a reflected XSS vulnerability in the\nFlowplayer flash video player (CVE-2015-5337).\n\nIn Moodle before 2.8.9, password-protected lesson modules are subject to a\nCSRF vulnerability in the lesson login form (CVE-2015-5338).\n\nIn Moodle before 2.8.9, through web service core_enrol_get_enrolled_users\nit is possible to retrieve list of course participants who would not be\nvisible when using web site (CVE-2015-5339).\n\nIn Moodle before 2.8.9, logged in users who do not have capability 'View\navailable badges without earning them' can still access the full list of\nbadges (CVE-2015-5340).\n\nIn Moodle before 2.8.9, the SCORM module allows to bypass access\nrestrictions based on date and lets users view the SCORM contents\n(CVE-2015-5341).\n\nIn Moodle before 2.8.9, the choice module closing date can be bypassed,\nallowing users to delete or submit new responses after the choice module\nwas closed (CVE-2015-5342).\n","status":"published","published":"2015-12-05T10:03:58Z","modified":"2026-04-16T06:23:28.78777463Z","updated_at":"2026-11-02T15:49:39.792687Z"}]}}