CVE-2015-5332

Moodle 2.8.x before 2.8.9 and 2.9.x before 2.9.3 are affected by CVE-2015-5332 due to the Atto editor autosave feature. An unauthenticated or guest user can trigger a denial of service (disk consumption) by entering drafts via the editor-autosave mechanism. The underlying issue is in the Atto edi...

MGASA-2015-0464 Updated moodle packages fix security vulnerability

In Moodle before 2.8.9, if guest access is open on the site, unauthenticated users can store Atto draft data through the editor autosave area, which could be exploited in a denial of service attack CVE-2015-5332. In Moodle before 2.8.9, due to a CSRF issue in the site registration form, it is...