Bug 1264828

Summary:	CVE-2015-5266 moodle: Meta course sync enroling suspended students as managers and causing large database growth (MSA-15-0033)
Product:	[Other] Security Response	Reporter:	Adam Mariš <amaris>
Component:	vulnerability	Assignee:	Red Hat Product Security <security-response-team>
Status:	CLOSED DUPLICATE	QA Contact:
Severity:	low	Docs Contact:
Priority:	low
Version:	unspecified	CC:	carry1, gwync, ignatenko
Target Milestone:	---	Keywords:	Security
Target Release:	---
Hardware:	All
OS:	Linux
Whiteboard:
Fixed In Version:	moodle 2.9.2, 2.8.8 and 2.7.10	Doc Type:	Bug Fix
Doc Text:		Story Points:	---
Clone Of:		Environment:
Last Closed:	2015-09-21 11:39:56 UTC	Type:	---
Regression:	---	Mount Type:	---
Documentation:	---	CRM:
Verified Versions:		Category:	---
oVirt Team:	---	RHEL 7.3 requirements from Atomic Host:
Cloudforms Team:	---	Target Upstream Version:
Embargoed:

Description Adam Mariš 2015-09-21 10:20:16 UTC

On large installations, when sync script takes a long time, suspended students may get assigned a manager role in meta course for several minutes. Affected versions are 2.9 to 2.9.1, 2.8 to 2.8.7, 2.7 to 2.7.9 and earlier unsupported versions.

Upstream patch:

https://git.moodle.org/gw?p=moodle.git&a=search&h=HEAD&st=commit&s=MDL-50744

Comment 1 Adam Mariš 2015-09-21 11:39:56 UTC


*** This bug has been marked as a duplicate of bug 1264861 ***

Comment 2 EvaJude 2023-03-18 06:03:02 UTC

Meta courses that were saved on the server, but not yet synced with MOODLE_MASTER, are now being synced with MOODLE_MASTER. This means that students who had previously been enrolled in these courses will be able to access them from their Moodle account. However, if a student is enrolled in any other course, they will be unable to access those courses until they are removed from all active courses. Students will also be unable to access meta courses until they are removed from their active courses. Now I would like to read reviews of Edusson at https://bravewords.com/news/edusson-review-is-it-legit-good-reliable-or-a-scam website in order to find out that is it legal to use Edusson for academic purposes.