PT-2007-3028 · Moodle · Moodle

Xsh · Publicado 2007-03-24 · Atualizado 2017-10-11 · CVE-2007-1647

Positive Technologies (AI Summary)

CVSS v2.0

7.8

Alta

Vetor base

AV:N/AC:L/Au:N/C:C/I:N/A:N

Name of the Vulnerable Software and Affected Versions: Moodle versions 1.5.2 and earlier

Description: The issue allows remote attackers to obtain sensitive information, including user names and password hashes, by directly requesting certain files. This is due to insufficient access control and the provision of directory listings for session files in the moodledata/sessions/ directory.

Recommendations: For Moodle versions 1.5.2 and earlier, consider restricting access to the moodledata/sessions/ directory to prevent unauthorized access to sensitive session files. As a temporary workaround, disable directory listings for this directory until a more permanent solution is implemented.

Exploit

Correção

Identificadores relacionados

CVE-2007-1647

Produtos afetados

Moodle

Referências · 5

• 🔥 https://exploit-db.com/exploits/3508 · Exploit
• https://nvd.nist.gov/vuln/detail/CVE-2007-1647 · Nota de Segurança
• https://exchange.xforce.ibmcloud.com/vulnerabilities/33147 · Nota
• https://cve.mitre.org/cgi-bin/cvename.cgi?name=CVE-2007-1647 · Nota
• http://osvdb.org/43558 · Nota