What is CVE-2015-3272?

CVE-2015-3272 is a high-severity vulnerability in Moodle. CVSS score: 7.4/10. Published 2016-02-22.

How severe is CVE-2015-3272?

High severity. CVSS v3 base score is 7.4 out of 10.

Vulnerability in Moodle

CVE-2015-3272

Open redirect vulnerability in the clean_param function in lib/moodlelib.php in Moodle through 2.6.11, 2.7.x before 2.7.9, 2.8.x before 2.8.7, and 2.9.x before 2.9.1 allows remote attackers to redirect users to arbitrary web sites and conduct phishing attacks via vectors involving an HTTP Referer header that has a substring match with a local URL.

EPSS: 0.018 (76.9th percentile) — read the EPSS interpretation.

CVSS v3 metric

CVSS v3 base score 7.4 (High). Vector: CVSS:3.0/AV:N/AC:L/PR:N/UI:R/S:C/C:N/I:H/A:N.

Affected products

Moodle — versions 2.6.0, 2.6.1, 2.6.2
N/a — versions n/a

References

secalert@redhat.com (x_refsource_CONFIRM, Vendor Advisory)
secalert@redhat.com (mailing-list, x_refsource_MLIST)
secalert@redhat.com (x_refsource_CONFIRM)
secalert@redhat.com (vdb-entry, x_refsource_SECTRACK)

Frequently asked questions

What is CVE-2015-3272?: CVE-2015-3272 is a high-severity vulnerability in Moodle. CVSS score: 7.4/10. Published 2016-02-22.
How severe is CVE-2015-3272?: High severity. CVSS v3 base score is 7.4 out of 10.