Atto in Moodle 2.8.x before 2.8.9 and 2.9.x before 2.9.3 allows remote attackers to cause a denial of service (disk consumption) by leveraging the guest role and entering drafts with the editor-autosave feature.

Moodle, an open-source course management system, installed on the remote host is version 2.8.x prior to 2.8.9, or 2.9.x prior to 2.9.3, and is affected by an unspecified flaw in the editor Autosave feature that is triggered when guest access is open on the site.  This may allow a remote attacker to conduct a DDoS attack.

Security update.

Note that Tenable Network Security has extracted the preceding description block directly from the Fedora security advisory. Tenable has attempted to automatically clean and format it as much as possible without introducing additional issues.

ID	Name	Product	Family	Type	Severity
9190	Moodle 2.8.x < 2.8.9 / 2.9.x < 2.9.3 Distributed DoS	Nessus Network Monitor	CGI		high
89333	Fedora 23 : moodle-2.9.3-1.fc23 (2015-98fc0d20ad)	Nessus	Fedora Local Security Checks	Local	high
89194	Fedora 22 : moodle-2.8.9-1.fc22 (2015-2ebdd4ad8f)	Nessus	Fedora Local Security Checks	Local	high

Detections

Analytics

CVE-2015-5332

medium

Tenable Plugins

high

high

high