PT-2014-3538 · Moodle · Moodle

Juan Leyva

·

Publicado

2014-05-19

·

Atualizado

2022-05-13

·

CVE-2014-0214

CVSS v2.0

6.8

Média

VetorAV:N/AC:M/Au:N/C:P/I:P/A:P
Name of the Vulnerable Software and Affected Versions Moodle versions 2.3.11 and earlier, 2.4.x before 2.4.10, 2.5.x before 2.5.6, 2.6.x before 2.6.3
Description The issue allows remote attackers to hijack sessions via a brute-force attack because login/token.php creates a MoodleMobile web-service token with an infinite lifetime.
Recommendations For versions 2.3.11 and earlier, update to version 2.4.10 or later to resolve the issue. For versions 2.4.x before 2.4.10, update to version 2.4.10 or later to resolve the issue. For versions 2.5.x before 2.5.6, update to version 2.5.6 or later to resolve the issue. For versions 2.6.x before 2.6.3, update to version 2.6.3 or later to resolve the issue.

Correção

Improper Authentication

Encontrou algum problema na descrição? Tem algo a acrescentar? Fique à vontade para nos escrever 👾
dbugs@ptsecurity.com

Enumeração de Fraquezas

CWE-287

Identificadores relacionados

CVE-2014-0214
GHSA-48RQ-VJ58-2MH6
MGASA-2014-0230

Produtos afetados

Moodle