Lucene search
HistoryMar 24, 2014 - 2:20 p.m.
CVE-2014-0125
cve-2014-0125
repository
alfresco
lib.php
moodle
security vulnerability
session key
url
remote attackers
file restrictions
alfresco repository
5.8 Medium
CVSS2
Attack Vector
NETWORK
Attack Complexity
MEDIUM
Authentication
NONE
Confidentiality Impact
PARTIAL
Integrity Impact
PARTIAL
Availability Impact
NONE
AV:N/AC:M/Au:N/C:P/I:P/A:N
6.4 Medium
AI Score
Confidence
Low
0.003 Low
EPSS
Percentile
65.3%
repository/alfresco/lib.php in Moodle through 2.3.11, 2.4.x before 2.4.9, 2.5.x before 2.5.5, and 2.6.x before 2.6.2 places a session key in a URL, which allows remote attackers to bypass intended Alfresco Repository file restrictions by impersonating a file’s owner.
Affected configurations
Node
moodlemoodleRange≤2.3.11
ORmoodlemoodleMatch2.0.0
ORmoodlemoodleMatch2.0.1
ORmoodlemoodleMatch2.0.2
ORmoodlemoodleMatch2.0.3
ORmoodlemoodleMatch2.0.4
ORmoodlemoodleMatch2.0.5
ORmoodlemoodleMatch2.0.6
ORmoodlemoodleMatch2.0.7
ORmoodlemoodleMatch2.0.8
ORmoodlemoodleMatch2.0.9
ORmoodlemoodleMatch2.1.0
ORmoodlemoodleMatch2.1.1
ORmoodlemoodleMatch2.1.2
ORmoodlemoodleMatch2.1.3
ORmoodlemoodleMatch2.1.4
ORmoodlemoodleMatch2.1.5
ORmoodlemoodleMatch2.1.6
ORmoodlemoodleMatch2.1.7
ORmoodlemoodleMatch2.1.8
ORmoodlemoodleMatch2.1.9
ORmoodlemoodleMatch2.1.10
ORmoodlemoodleMatch2.2.0
ORmoodlemoodleMatch2.2.1
ORmoodlemoodleMatch2.2.2
ORmoodlemoodleMatch2.2.3
ORmoodlemoodleMatch2.2.4
ORmoodlemoodleMatch2.2.5
ORmoodlemoodleMatch2.2.6
ORmoodlemoodleMatch2.2.7
ORmoodlemoodleMatch2.2.8
ORmoodlemoodleMatch2.2.9
ORmoodlemoodleMatch2.2.10
ORmoodlemoodleMatch2.2.11
ORmoodlemoodleMatch2.3.0
ORmoodlemoodleMatch2.3.1
ORmoodlemoodleMatch2.3.2
ORmoodlemoodleMatch2.3.3
ORmoodlemoodleMatch2.3.4
ORmoodlemoodleMatch2.3.5
ORmoodlemoodleMatch2.3.6
ORmoodlemoodleMatch2.3.7
ORmoodlemoodleMatch2.3.8
ORmoodlemoodleMatch2.3.9
ORmoodlemoodleMatch2.3.10
ORmoodlemoodleMatch2.4.0
ORmoodlemoodleMatch2.4.1
ORmoodlemoodleMatch2.4.2
ORmoodlemoodleMatch2.4.3
ORmoodlemoodleMatch2.4.4
ORmoodlemoodleMatch2.4.5
ORmoodlemoodleMatch2.4.6
ORmoodlemoodleMatch2.4.7
ORmoodlemoodleMatch2.4.8
ORmoodlemoodleMatch2.5.0
ORmoodlemoodleMatch2.5.1
ORmoodlemoodleMatch2.5.2
ORmoodlemoodleMatch2.5.3
ORmoodlemoodleMatch2.5.4
ORmoodlemoodleMatch2.6.0
ORmoodlemoodleMatch2.6.1
Related
ubuntucve
ubuntucve
CVE-2014-0125
2014-03-24 00:00:00
veracode
veracode
Impersonation Attack
2017-07-14 08:57:35
prion
prion
Design/Logic Flaw
2014-03-24 14:20:00
cvelist
cvelist
CVE-2014-0125
2014-03-22 01:00:00
osv
osv
Moodle places a session key in a URL
2022-05-13 01:12:50
nvd
nvd
CVE-2014-0125
2014-03-24 14:20:39
github
github
Moodle places a session key in a URL
2022-05-13 01:12:50
nessus
nessus
Fedora 20 : moodle-2.5.5-1.fc20 (2014-4163)
2014-03-31 00:00:00
Fedora 19 : moodle-2.4.9-1.fc19 (2014-4152)
2014-03-31 00:00:00
Moodle 2.4.x < 2.4.9 Multiple Vulnerabilities
2016-07-21 00:00:00
openvas
openvas
Fedora Update for moodle FEDORA-2014-4163
2014-04-03 00:00:00
Mageia: Security Advisory (MGASA-2014-0160)
2022-01-28 00:00:00
Fedora Update for moodle FEDORA-2014-4163
2014-04-03 00:00:00
mageia
mageia
Updated moodle packages fix multiple security vulnerabilities
2014-04-03 21:23:49
fedora
fedora
[SECURITY] Fedora 20 Update: moodle-2.5.5-1.fc20
2014-03-30 06:16:54
[SECURITY] Fedora 19 Update: moodle-2.4.9-1.fc19
2014-03-30 06:10:35
[SECURITY] Fedora 20 Update: moodle-2.5.6-1.fc20
2014-05-29 23:27:45
5.8 Medium
CVSS2
Attack Vector
NETWORK
Attack Complexity
MEDIUM
Authentication
NONE
Confidentiality Impact
PARTIAL
Integrity Impact
PARTIAL
Availability Impact
NONE
AV:N/AC:M/Au:N/C:P/I:P/A:N
6.4 Medium
AI Score
Confidence
Low
0.003 Low
EPSS
Percentile
65.3%
Related for CVE-2014-0125