PT-2007-3028 · Moodle · Moodle

Xsh · Published 2007-03-24 · Updated 2017-10-11 · CVE-2007-1647

Positive Technologies (AI Summary)

CVSS v2.0

7.8

High

Base vector

AV:N/AC:L/Au:N/C:C/I:N/A:N

Name of the Vulnerable Software and Affected Versions: Moodle versions 1.5.2 and earlier

Description: The issue allows remote attackers to obtain sensitive information, including user names and password hashes, by directly requesting certain files. This is due to insufficient access control and the provision of directory listings for session files in the moodledata/sessions/ directory.

Recommendations: For Moodle versions 1.5.2 and earlier, consider restricting access to the moodledata/sessions/ directory to prevent unauthorized access to sensitive session files. As a temporary workaround, disable directory listings for this directory until a more permanent solution is implemented.

Exploit

Fix

Related Identifiers

CVE-2007-1647

Affected Products

Moodle

References · 5

• 🔥 https://exploit-db.com/exploits/3508 · Exploit
• https://nvd.nist.gov/vuln/detail/CVE-2007-1647 · Security Note
• https://exchange.xforce.ibmcloud.com/vulnerabilities/33147 · Note
• https://cve.mitre.org/cgi-bin/cvename.cgi?name=CVE-2007-1647 · Note
• http://osvdb.org/43558 · Note