CVE-2015-5264

5.4 mediumEPSS 1.4%

The lesson module in Moodle through 2.6.11, 2.7.x before 2.7.10, 2.8.x before 2.8.8, and 2.9.x before 2.9.2 allows remote authenticated users to bypass intended access restrictions and enter additional answer attempts by leveraging the student role.

Severity

CVSS 3.0

5.4 medium

CVSS:3.0/AV:N/AC:L/PR:L/UI:N/S:U/C:L/I:L/A:N

EPSS: 1.4% chance of exploitation in the next 30 days; higher than 72% of CVEs (scores of 2026-10-31)
CWE: CWE-264
Published: 2016-02-22
Modified: 2026-06-17
Record from: the NVD, synced 2026-10-19

Affected

moodle:moodle

References

http://git.moodle.org/gw?p=moodle.git&a=search&h=HEAD&st=commit&s=MDL-50516
http://www.openwall.com/lists/oss-security/2015/09/21/1
http://www.securitytracker.com/id/1033619
https://moodle.org/mod/forum/discuss.php?d=320287
http://git.moodle.org/gw?p=moodle.git&a=search&h=HEAD&st=commit&s=MDL-50516

Check your stack JSON