| Title | Moodle の enrol/meta/locallib.php の enrol_meta_sync 関数における管理者権限を取得される脆弱性 |
|---|---|
| Summary | Moodle の enrol/meta/locallib.php の enrol_meta_sync 関数には、管理者権限を取得される脆弱性が存在します。 |
| Possible impacts | リモート認証されたユーザにより、同期スクリプトの長時間実行中に不正なロール処理を利用されることで、管理者権限を取得される可能性があります。 |
| Solution | ベンダより正式な対策が公開されています。ベンダ情報を参照して適切な対策を実施してください。 |
| Publication Date | Sept. 21, 2015, midnight |
| Registration Date | March 3, 2016, 3:46 p.m. |
| Last Update | March 3, 2016, 3:46 p.m. |
| CVSS2.0 : 警告 | |
| Score | 4.9 |
|---|---|
| Vector | AV:N/AC:M/Au:S/C:P/I:P/A:N |
| Moodle |
| Moodle 2.6.11 まで |
| Moodle 2.7.10 未満の 2.7.x |
| Moodle 2.8.8 未満の 2.8.x |
| Moodle 2.9.2 未満の 2.9.x |
| Moodle 2.6.11 まで |
| Moodle 2.7.10 未満の 2.7.x |
| Moodle 2.8.8 未満の 2.8.x |
| Moodle 2.9.2 未満の 2.9.x |
| No | Changed Details | Date of change |
|---|---|---|
| 0 | [2016年03月03日] 掲載 |
Feb. 17, 2018, 10:37 a.m. |
| Summary | The enrol_meta_sync function in enrol/meta/locallib.php in Moodle through 2.6.11, 2.7.x before 2.7.10, 2.8.x before 2.8.8, and 2.9.x before 2.9.2 allows remote authenticated users to obtain manager privileges in opportunistic circumstances by leveraging incorrect role processing during a long-running sync script. |
|---|---|
| Publication Date | Feb. 22, 2016, 2:59 p.m. |
| Registration Date | Jan. 26, 2021, 2:52 p.m. |
| Last Update | Nov. 21, 2024, 11:32 a.m. |
| Configuration1 | or higher | or less | more than | less than | |
| cpe:2.3:a:moodle:moodle:2.7.1:*:*:*:*:*:*:* | |||||
| cpe:2.3:a:moodle:moodle:2.8.3:*:*:*:*:*:*:* | |||||
| cpe:2.3:a:moodle:moodle:2.8.7:*:*:*:*:*:*:* | |||||
| cpe:2.3:a:moodle:moodle:2.7.6:*:*:*:*:*:*:* | |||||
| cpe:2.3:a:moodle:moodle:2.7.2:*:*:*:*:*:*:* | |||||
| cpe:2.3:a:moodle:moodle:2.7.4:*:*:*:*:*:*:* | |||||
| cpe:2.3:a:moodle:moodle:2.7.9:*:*:*:*:*:*:* | |||||
| cpe:2.3:a:moodle:moodle:2.8.4:*:*:*:*:*:*:* | |||||
| cpe:2.3:a:moodle:moodle:2.8.6:*:*:*:*:*:*:* | |||||
| cpe:2.3:a:moodle:moodle:*:*:*:*:*:*:*:* | 2.6.11 | ||||
| cpe:2.3:a:moodle:moodle:2.7.5:*:*:*:*:*:*:* | |||||
| cpe:2.3:a:moodle:moodle:2.7.3:*:*:*:*:*:*:* | |||||
| cpe:2.3:a:moodle:moodle:2.7.0:*:*:*:*:*:*:* | |||||
| cpe:2.3:a:moodle:moodle:2.9.1:*:*:*:*:*:*:* | |||||
| cpe:2.3:a:moodle:moodle:2.8.1:*:*:*:*:*:*:* | |||||
| cpe:2.3:a:moodle:moodle:2.8.5:*:*:*:*:*:*:* | |||||
| cpe:2.3:a:moodle:moodle:2.7.8:*:*:*:*:*:*:* | |||||
| cpe:2.3:a:moodle:moodle:2.8.2:*:*:*:*:*:*:* | |||||
| cpe:2.3:a:moodle:moodle:2.7.7:*:*:*:*:*:*:* | |||||
| cpe:2.3:a:moodle:moodle:2.8.0:*:*:*:*:*:*:* | |||||
| cpe:2.3:a:moodle:moodle:2.9.0:*:*:*:*:*:*:* | |||||