NVD Vulnerability Detail

CVE-2015-5341

Summary	mod_scorm in Moodle through 2.6.11, 2.7.x before 2.7.11, 2.8.x before 2.8.9, and 2.9.x before 2.9.3 mishandles availability dates, which allows remote authenticated users to bypass intended access restrictions and read SCORM contents via unspecified vectors.
Publication Date	Feb. 22, 2016, 2:59 p.m.
Registration Date	Jan. 26, 2021, 2:52 p.m.
Last Update	Nov. 21, 2024, 11:32 a.m.

Affected software configurations

Related information, measures and tools

No	URL	タグ
1	http://git.moodle.org/gw?p=moodle.git&a=search&h=HEAD&st=commit&s=MDL-50837
2	http://git.moodle.org/gw?p=moodle.git&a=search&h=HEAD&st=commit&s=MDL-50837
3	https://moodle.org/mod/forum/discuss.php?d=323236	Vendor Advisory
4	https://moodle.org/mod/forum/discuss.php?d=323236	Vendor Advisory

Common Vulnerabilities List

No	CWE	Name	URL
1	CWE-200	情報漏えい	https://cwe.mitre.org/data/definitions/200.html
2	CWE-264	認可・権限・アクセス制御	https://cwe.mitre.org/data/definitions/264.html

JVN Vulnerability Information

Moodle の mod_scorm におけるアクセス制限を回避される脆弱性

Title	Moodle の mod_scorm におけるアクセス制限を回避される脆弱性
Summary	Moodle の mod_scorm は、可能日 (availability dates) を誤って処理するため、アクセス制限を回避され、SCORM のコンテンツを読まれる脆弱性が存在します。
Possible impacts	リモート認証されたユーザにより、アクセス制限を回避され、SCORM のコンテンツを読まれる可能性があります。
Solution	ベンダより正式な対策が公開されています。ベンダ情報を参照して適切な対策を実施してください。
Publication Date	Nov. 16, 2015, midnight
Registration Date	March 3, 2016, 3:48 p.m.
Last Update	March 3, 2016, 3:48 p.m.

Affected System

Moodle

Moodle 2.6.11 まで

Moodle 2.7.11 未満の 2.7.x

Moodle 2.8.9 未満の 2.8.x

Moodle 2.9.3 未満の 2.9.x

Moodle 2.6.11 まで

Moodle 2.7.11 未満の 2.7.x

Moodle 2.8.9 未満の 2.8.x

Moodle 2.9.3 未満の 2.9.x

CVE (情報セキュリティ共通脆弱性識別子)

No	Name	URL
Common Vulnerabilities and Exposures (CVE)
1	CVE-2015-5341	http://cve.mitre.org/cgi-bin/cvename.cgi?name=CVE-2015-5341
2	CVE-2015-5341	http://cve.mitre.org/cgi-bin/cvename.cgi?name=CVE-2015-5341
National Vulnerability Database (NVD)
3	CVE-2015-5341	http://web.nvd.nist.gov/view/vuln/detail?vulnId=CVE-2015-5341
4	CVE-2015-5341	http://web.nvd.nist.gov/view/vuln/detail?vulnId=CVE-2015-5341

CWE (共通脆弱性タイプ一覧)

No	Name	URL
JVNDB
1	CWE-200	https://jvndb.jvn.jp/ja/cwe/CWE-200.html
2	CWE-200	https://jvndb.jvn.jp/ja/cwe/CWE-200.html
3	CWE-264	https://jvndb.jvn.jp/ja/cwe/CWE-264.html
4	CWE-264	https://jvndb.jvn.jp/ja/cwe/CWE-264.html

ベンダー情報

No	Name	URL
Moodle
1	MDL-50837	https://git.moodle.org/gw?p=moodle.git&a=search&h=HEAD&st=commit&s=MDL-50837
2	MDL-50837	https://git.moodle.org/gw?p=moodle.git&a=search&h=HEAD&st=commit&s=MDL-50837
Security Announcements
3	MSA-15-0045: SCORM module allows to bypass access restrictions based on date	https://moodle.org/mod/forum/discuss.php?d=323236
4	MSA-15-0045: SCORM module allows to bypass access restrictions based on date	https://moodle.org/mod/forum/discuss.php?d=323236

Change Log

No	Changed Details	Date of change
0	[2016年03月03日] 掲載	Feb. 17, 2018, 10:37 a.m.