Lucene search
HistoryMar 24, 2014 - 2:20 p.m.
CVE-2014-0125
cve-2014-0125
repository
alfresco
lib.php
moodle
security vulnerability
session key
url
remote attackers
file restrictions
alfresco repository
6.4 Medium
AI Score
Confidence
Low
5.8 Medium
CVSS2
Access Vector
Access Complexity
Authentication
NONE
Confidentiality Impact
PARTIAL
Integrity Impact
PARTIAL
Availability Impact
NONE
AV:N/AC:M/Au:N/C:P/I:P/A:N
0.003 Low
EPSS
Percentile
65.3%
repository/alfresco/lib.php in Moodle through 2.3.11, 2.4.x before 2.4.9, 2.5.x before 2.5.5, and 2.6.x before 2.6.2 places a session key in a URL, which allows remote attackers to bypass intended Alfresco Repository file restrictions by impersonating a file’s owner.
Affected configurations
Node
moodlemoodleRange≤2.3.11
ORmoodlemoodleMatch2.0.0
ORmoodlemoodleMatch2.0.1
ORmoodlemoodleMatch2.0.2
ORmoodlemoodleMatch2.0.3
ORmoodlemoodleMatch2.0.4
ORmoodlemoodleMatch2.0.5
ORmoodlemoodleMatch2.0.6
ORmoodlemoodleMatch2.0.7
ORmoodlemoodleMatch2.0.8
ORmoodlemoodleMatch2.0.9
ORmoodlemoodleMatch2.1.0
ORmoodlemoodleMatch2.1.1
ORmoodlemoodleMatch2.1.2
ORmoodlemoodleMatch2.1.3
ORmoodlemoodleMatch2.1.4
ORmoodlemoodleMatch2.1.5
ORmoodlemoodleMatch2.1.6
ORmoodlemoodleMatch2.1.7
ORmoodlemoodleMatch2.1.8
ORmoodlemoodleMatch2.1.9
ORmoodlemoodleMatch2.1.10
ORmoodlemoodleMatch2.2.0
ORmoodlemoodleMatch2.2.1
ORmoodlemoodleMatch2.2.2
ORmoodlemoodleMatch2.2.3
ORmoodlemoodleMatch2.2.4
ORmoodlemoodleMatch2.2.5
ORmoodlemoodleMatch2.2.6
ORmoodlemoodleMatch2.2.7
ORmoodlemoodleMatch2.2.8
ORmoodlemoodleMatch2.2.9
ORmoodlemoodleMatch2.2.10
ORmoodlemoodleMatch2.2.11
ORmoodlemoodleMatch2.3.0
ORmoodlemoodleMatch2.3.1
ORmoodlemoodleMatch2.3.2
ORmoodlemoodleMatch2.3.3
ORmoodlemoodleMatch2.3.4
ORmoodlemoodleMatch2.3.5
ORmoodlemoodleMatch2.3.6
ORmoodlemoodleMatch2.3.7
ORmoodlemoodleMatch2.3.8
ORmoodlemoodleMatch2.3.9
ORmoodlemoodleMatch2.3.10
ORmoodlemoodleMatch2.4.0
ORmoodlemoodleMatch2.4.1
ORmoodlemoodleMatch2.4.2
ORmoodlemoodleMatch2.4.3
ORmoodlemoodleMatch2.4.4
ORmoodlemoodleMatch2.4.5
ORmoodlemoodleMatch2.4.6
ORmoodlemoodleMatch2.4.7
ORmoodlemoodleMatch2.4.8
ORmoodlemoodleMatch2.5.0
ORmoodlemoodleMatch2.5.1
ORmoodlemoodleMatch2.5.2
ORmoodlemoodleMatch2.5.3
ORmoodlemoodleMatch2.5.4
ORmoodlemoodleMatch2.6.0
ORmoodlemoodleMatch2.6.1
Related
prion
prion
Design/Logic Flaw
2014-03-24 14:20:00
veracode
veracode
Impersonation Attack
2017-07-14 08:57:35
ubuntucve
ubuntucve
CVE-2014-0125
2014-03-24 00:00:00
cvelist
cvelist
CVE-2014-0125
2014-03-22 01:00:00
github
github
Moodle places a session key in a URL
2022-05-13 01:12:50
osv
osv
Moodle places a session key in a URL
2022-05-13 01:12:50
nvd
nvd
CVE-2014-0125
2014-03-24 14:20:39
nessus
nessus
Fedora 19 : moodle-2.4.9-1.fc19 (2014-4152)
2014-03-31 00:00:00
Moodle 2.4.x < 2.4.9 Multiple Vulnerabilities
2016-07-21 00:00:00
Fedora 20 : moodle-2.5.5-1.fc20 (2014-4163)
2014-03-31 00:00:00
fedora
fedora
[SECURITY] Fedora 20 Update: moodle-2.5.5-1.fc20
2014-03-30 06:16:54
[SECURITY] Fedora 19 Update: moodle-2.4.9-1.fc19
2014-03-30 06:10:35
[SECURITY] Fedora 20 Update: moodle-2.5.6-1.fc20
2014-05-29 23:27:45
openvas
openvas
Fedora Update for moodle FEDORA-2014-4163
2014-04-03 00:00:00
Fedora Update for moodle FEDORA-2014-4163
2014-04-03 00:00:00
Mageia: Security Advisory (MGASA-2014-0160)
2022-01-28 00:00:00
mageia
mageia
Updated moodle packages fix multiple security vulnerabilities
2014-04-03 21:23:49
6.4 Medium
AI Score
Confidence
Low
5.8 Medium
CVSS2
Access Vector
Access Complexity
Authentication
NONE
Confidentiality Impact
PARTIAL
Integrity Impact
PARTIAL
Availability Impact
NONE
AV:N/AC:M/Au:N/C:P/I:P/A:N
0.003 Low
EPSS
Percentile
65.3%
Related for CVE-2014-0125