PT-2016-1295 · Moodle · Moodle

Us3R777 + 1 · Published 2015-09-23 · Updated 2022-05-13 · CVE-2015-5267

Positive Technologies (AI Summary)

CVSS v3.1

7.5

High

Base vector

AV:N/AC:L/PR:N/UI:N/S:U/C:H/I:N/A:N

Name of the Vulnerable Software and Affected Versions Moodle versions 2.6.11 and earlier, 2.7.x before 2.7.10, 2.8.x before 2.8.8, 2.9.x before 2.9.2

Description The issue is related to the implementation of the random string and complex random string functions in the Moodle learning management system, which relies on the PHP mt rand function. This weakness can be exploited by a remote attacker to predict password-recovery tokens using a brute-force approach, potentially allowing them to obtain a user's password.

Recommendations For Moodle versions 2.6.11 and earlier, update to version 2.7.10 or later. For Moodle versions 2.7.x before 2.7.10, update to version 2.7.10 or later. For Moodle versions 2.8.x before 2.8.8, update to version 2.8.8 or later. For Moodle versions 2.9.x before 2.9.2, update to version 2.9.2 or later.

Fix

Information Disclosure

Weakness Enumeration

CWE-254

CWE-264

CWE-200

Related Identifiers

BDU:2016-00592

CVE-2015-5267

GHSA-382V-GXJ9-FFHC

MGASA-2015-0381

Affected Products

Moodle

References · 30

• https://bdu.fstec.ru/vul/2016-00592 · Security Note
• https://advisories.mageia.org/MGASA-2015-0381.html · Security Note
• https://osv.dev/vulnerability/GHSA-382v-gxj9-ffhc · Vendor Advisory
• https://ubuntu.com/security/CVE-2015-5267 · Vendor Advisory
• https://moodle.org/mod/forum/discuss.php?d=320291 · Vendor Advisory
• https://nvd.nist.gov/vuln/detail/CVE-2015-5267 · Security Note
• https://cve.org/CVERecord?id=CVE-2015-5267 · Security Note
• https://osv.dev/vulnerability/MGASA-2015-0381 · Vendor Advisory
• https://osv.dev/vulnerability/UBUNTU-CVE-2015-5267 · Vendor Advisory
• https://github.com/moodle/moodle · Note
• https://github.com/moodle/moodle/commit/6e8224365ffcdf328458ea7852dc62574e806119 · Note
• https://github.com/moodle/moodle/commit/e4ac3879c2d1f8fe66caa74ff1544248bccef61e · Note
• https://github.com/moodle/moodle/commit/5337b2295237958c93b6c65fa595859aaa7bf257 · Note
• https://github.com/moodle/moodle/commit/289bc7f9e3022918b4cfd2cc9851472f0cea2896 · Note
• https://moodle.org/mod/forum/discuss.php?d=320289 · Note