PT-2014-3538 · Moodle · Moodle

Juan Leyva · Published 2014-05-19 · Updated 2022-05-13 · CVE-2014-0214

Positive Technologies (AI Summary)

CVSS v2.0

6.8

Medium

Base vector

AV:N/AC:M/Au:N/C:P/I:P/A:P

Name of the Vulnerable Software and Affected Versions Moodle versions 2.3.11 and earlier, 2.4.x before 2.4.10, 2.5.x before 2.5.6, 2.6.x before 2.6.3

Description The issue allows remote attackers to hijack sessions via a brute-force attack because login/token.php creates a MoodleMobile web-service token with an infinite lifetime.

Recommendations For versions 2.3.11 and earlier, update to version 2.4.10 or later to resolve the issue. For versions 2.4.x before 2.4.10, update to version 2.4.10 or later to resolve the issue. For versions 2.5.x before 2.5.6, update to version 2.5.6 or later to resolve the issue. For versions 2.6.x before 2.6.3, update to version 2.6.3 or later to resolve the issue.

Fix

Improper Authentication

Weakness Enumeration

CWE-287

Related Identifiers

CVE-2014-0214

GHSA-48RQ-VJ58-2MH6

MGASA-2014-0230

Affected Products

Moodle

References · 19

• https://advisories.mageia.org/MGASA-2014-0230.html · Security Note
• https://moodle.org/mod/forum/discuss.php?d=260362 · Vendor Advisory
• https://osv.dev/vulnerability/MGASA-2014-0230 · Vendor Advisory
• https://nvd.nist.gov/vuln/detail/CVE-2014-0214 · Security Note
• https://osv.dev/vulnerability/GHSA-48rq-vj58-2mh6 · Vendor Advisory
• https://github.com/moodle/moodle · Note
• https://github.com/moodle/moodle/commit/437240b5aa7719f1b8cce1e0f45ac0708c72cc23 · Note
• https://github.com/moodle/moodle/commit/679e323aaab2a968b8e87862e1658814645db525 · Note
• https://github.com/moodle/moodle/commit/b5b2eab6778bee166e20bc5eec0138d89795ac3d · Note
• https://github.com/moodle/moodle/commit/14c16a416373f68c36b65f4653c0bd076eb0b290 · Note
• http://git.moodle.org/gw?p=moodle.git&a=search&h=HEAD&st=commit&s=MDL-43119 · Note
• https://moodle.org/mod/forum/discuss.php?d=260366 · Note
• https://moodle.org/mod/forum/discuss.php?d=260364 · Note
• https://bugs.mageia.org/show_bug.cgi?id=13369 · Note
• https://moodle.org/mod/forum/discuss.php?d=260361 · Note