Lucene search
K
Database
Vendors
Products
Years
CVSS
Scanner
Agent Scanning
API Scanning
Manual Audit
Perimeter Scanner
Scanning
Projects
Email
Webhook
Plugins
Resources
Documents
Blog
Glossary
FAQ
Pricing
Contacts
About Us
Partners
Branding Guideline
githubGitHub Advisory DatabaseGHSA-382V-GXJ9-FFHC
HistoryMay 13, 2022 - 1:12 a.m.

Moodle uses predictable password-recovery tokens

2022-05-1301:12:47
CWE-200
GitHub Advisory Database
github.com
7
moodle
password recovery
vulnerability
php
remote attackers
brute-force

CVSS2

5

Attack Vector

NETWORK

Attack Complexity

LOW

Authentication

NONE

Confidentiality Impact

PARTIAL

Integrity Impact

NONE

Availability Impact

NONE

AV:N/AC:L/Au:N/C:P/I:N/A:N

CVSS3

7.5

Attack Vector

NETWORK

Attack Complexity

LOW

Privileges Required

NONE

User Interaction

NONE

Scope

UNCHANGED

Confidentiality Impact

HIGH

Integrity Impact

NONE

Availability Impact

NONE

CVSS:3.0/AV:N/AC:L/PR:N/UI:N/S:U/C:H/I:N/A:N

AI Score

7.2

Confidence

Low

EPSS

0.003

Percentile

71.5%

JSON

lib/moodlelib.php in Moodle through 2.6.11, 2.7.x before 2.7.10, 2.8.x before 2.8.8, and 2.9.x before 2.9.2 relies on the PHP mt_rand function to implement the random_string and complex_random_string functions, which makes it easier for remote attackers to predict password-recovery tokens via a brute-force approach.

Affected configurations

Vulners
Node
moodlemoodleRange2.9.0–2.9.2
OR
moodlemoodleRange2.8.0–2.8.8
OR
moodlemoodleRange<2.7.10
VendorProductVersionCPE
moodlemoodle*cpe:2.3:a:moodle:moodle:*:*:*:*:*:*:*:*

Related

nvd 1
cve 1
osv 1
veracode 1
ubuntucve 1
prion 1
cvelist 1
openvas 2
mageia 1
nessus 4
freebsd 1
nvd
nvd
CVE-2015-5267
2016-02-22 05:59:07
cve
cve
CVE-2015-5267
2016-02-22 05:59:07
osv
osv
Moodle uses predictable password-recovery tokens
2022-05-13 01:12:47
veracode
veracode
Predictable Password Recovery
2017-07-26 03:04:39
ubuntucve
ubuntucve
CVE-2015-5267
2016-02-22 00:00:00
prion
prion
Code injection
2016-02-22 05:59:00
cvelist
cvelist
CVE-2015-5267
2016-02-22 02:00:00
openvas
openvas
Mageia: Security Advisory (MGASA-2015-0381)
2015-10-15 00:00:00
Fedora Update for moodle FEDORA-2015-2
2015-12-12 00:00:00
mageia
mageia
Updated moodle packages fix security vulnerabilities
2015-09-23 22:42:52
nessus
nessus
FreeBSD : moodle -- multiple vulnerabilities (c2fcbec2-5daa-11e5-9909-002590263bf5)
2015-09-18 00:00:00
Moodle 2.7.x < 2.7.10 / 2.8.x < 2.8.8 / 2.9.x < 2.9.2 Multiple Vulnerabilities
2015-10-07 00:00:00
Fedora 23 : moodle-2.9.3-1.fc23 (2015-98fc0d20ad)
2016-03-04 00:00:00
freebsd
freebsd
moodle -- multiple vulnerabilities
2015-09-14 00:00:00

CVSS2

5

Attack Vector

NETWORK

Attack Complexity

LOW

Authentication

NONE

Confidentiality Impact

PARTIAL

Integrity Impact

NONE

Availability Impact

NONE

AV:N/AC:L/Au:N/C:P/I:N/A:N

CVSS3

7.5

Attack Vector

NETWORK

Attack Complexity

LOW

Privileges Required

NONE

User Interaction

NONE

Scope

UNCHANGED

Confidentiality Impact

HIGH

Integrity Impact

NONE

Availability Impact

NONE

CVSS:3.0/AV:N/AC:L/PR:N/UI:N/S:U/C:H/I:N/A:N

AI Score

7.2

Confidence

Low

EPSS

0.003

Percentile

71.5%

JSON
Related for GHSA-382V-GXJ9-FFHC
nvd1cve1osv1veracode1ubuntucve1prion1cvelist1openvas2mageia1nessus4freebsd1