Lucene search

[email protected]CVE-2014-0127

HistoryMar 24, 2014 - 2:20 p.m.

CVE-2014-0127

2014-03-2414:20:39

CWE-264

[email protected]

web.nvd.nist.gov

cve-2014-0127

time-validation

implementation

bypass

moodle

remote authenticated users

feedback activity

4.9 Medium

CVSS2

Attack Vector

NETWORK

Attack Complexity

MEDIUM

Authentication

SINGLE

Confidentiality Impact

PARTIAL

Integrity Impact

PARTIAL

Availability Impact

NONE

AV:N/AC:M/Au:S/C:P/I:P/A:N

6 Medium

AI Score

Confidence

Low

0.001 Low

EPSS

Percentile

46.8%

JSON

The time-validation implementation in (1) mod/feedback/complete.php and (2) mod/feedback/complete_guest.php in Moodle through 2.3.11, 2.4.x before 2.4.9, 2.5.x before 2.5.5, and 2.6.x before 2.6.2 allows remote authenticated users to bypass intended restrictions on starting a Feedback activity by choosing an unavailable time.

Affected configurations

NVD

Node

moodlemoodleRange≤2.3.11

moodlemoodleMatch2.0.0

moodlemoodleMatch2.0.1

moodlemoodleMatch2.0.2

moodlemoodleMatch2.0.3

moodlemoodleMatch2.0.4

moodlemoodleMatch2.0.5

moodlemoodleMatch2.0.6

moodlemoodleMatch2.0.7

moodlemoodleMatch2.0.8

moodlemoodleMatch2.0.9

moodlemoodleMatch2.1.0

moodlemoodleMatch2.1.1

moodlemoodleMatch2.1.2

moodlemoodleMatch2.1.3

moodlemoodleMatch2.1.4

moodlemoodleMatch2.1.5

moodlemoodleMatch2.1.6

moodlemoodleMatch2.1.7

moodlemoodleMatch2.1.8

moodlemoodleMatch2.1.9

moodlemoodleMatch2.1.10

moodlemoodleMatch2.2.0

moodlemoodleMatch2.2.1

moodlemoodleMatch2.2.2

moodlemoodleMatch2.2.3

moodlemoodleMatch2.2.4

moodlemoodleMatch2.2.5

moodlemoodleMatch2.2.6

moodlemoodleMatch2.2.7

moodlemoodleMatch2.2.8

moodlemoodleMatch2.2.9

moodlemoodleMatch2.2.10

moodlemoodleMatch2.2.11

moodlemoodleMatch2.3.0

moodlemoodleMatch2.3.1

moodlemoodleMatch2.3.2

moodlemoodleMatch2.3.3

moodlemoodleMatch2.3.4

moodlemoodleMatch2.3.5

moodlemoodleMatch2.3.6

moodlemoodleMatch2.3.7

moodlemoodleMatch2.3.8

moodlemoodleMatch2.3.9

moodlemoodleMatch2.3.10

moodlemoodleMatch2.4.0

moodlemoodleMatch2.4.1

moodlemoodleMatch2.4.2

moodlemoodleMatch2.4.3

moodlemoodleMatch2.4.4

moodlemoodleMatch2.4.5

moodlemoodleMatch2.4.6

moodlemoodleMatch2.4.7

moodlemoodleMatch2.4.8

moodlemoodleMatch2.5.0

moodlemoodleMatch2.5.1

moodlemoodleMatch2.5.2

moodlemoodleMatch2.5.3

moodlemoodleMatch2.5.4

moodlemoodleMatch2.6.0

moodlemoodleMatch2.6.1

CPENameOperatorVersion
moodle:moodlemoodlele2.3.11
moodle:moodlemoodleeq2.0.0
moodle:moodlemoodleeq2.0.1
moodle:moodlemoodleeq2.0.2
moodle:moodlemoodleeq2.0.3
moodle:moodlemoodleeq2.0.4
moodle:moodlemoodleeq2.0.5
moodle:moodlemoodleeq2.0.6
moodle:moodlemoodleeq2.0.7
moodle:moodlemoodleeq2.0.8

CPE	Name	Operator	Version
moodle:moodle	moodle	le	2.3.11
moodle:moodle	moodle	eq	2.0.0
moodle:moodle	moodle	eq	2.0.1
moodle:moodle	moodle	eq	2.0.2
moodle:moodle	moodle	eq	2.0.3
moodle:moodle	moodle	eq	2.0.4
moodle:moodle	moodle	eq	2.0.5
moodle:moodle	moodle	eq	2.0.6
moodle:moodle	moodle	eq	2.0.7
moodle:moodle	moodle	eq	2.0.8