GHSA-5659-G9P4-354F Moodle allows attackers to bypass a forced-password-change requirement

login/token.php in Moodle through 2.5.9, 2.6.x before 2.6.9, 2.7.x before 2.7.6, and 2.8.x before 2.8.4 allows remote authenticated users to bypass a forced-password-change requirement by creating a web-services token...

CVE-2015-2272

login/token.php in Moodle through 2.5.9, 2.6.x before 2.6.9, 2.7.x before 2.7.6, and 2.8.x before 2.8.4 allows remote authenticated users to bypass a forced-password-change requirement by creating a web-services token...

CVE-2015-2272: Undefined Security Weakness

login/token.php in Moodle through 2.5.9, 2.6.x before 2.6.9, 2.7.x before 2.7.6, and 2.8.x before 2.8.4 allows remote authenticated users to bypass a forced-password-change requirement by creating a web-services token...

PT-2015-1593

Name of the Vulnerable Software and Affected Versions Moodle versions 2.5.9 and earlier, 2.6.x before 2.6.9, 2.7.x before 2.7.6, 2.8.x before 2.8.4 Description The issue is related to insufficient access control in the login/token.php component of the Moodle learning management system. This allow...

CVE-2014-0214

CVE-2014-0214 affects Moodle versions up to 2.3.11, 2.4.x before 2.4.10, 2.5.x before 2.5.6, and 2.6.x before 2.6.3. The vulnerability arises in login/token.php, which creates a MoodleMobile web-service token with an infinite lifetime. This allows remote attackers to hijack sessions more easily v...

CVE-2014-0214

login/token.php in Moodle through 2.3.11, 2.4.x before 2.4.10, 2.5.x before 2.5.6, and 2.6.x before 2.6.3 creates a MoodleMobile web-service token with an infinite lifetime, which makes it easier for remote attackers to hijack sessions via a brute-force attack...

CVE-2014-0214: Improper Authentication

login/token.php in Moodle through 2.3.11, 2.4.x before 2.4.10, 2.5.x before 2.5.6, and 2.6.x before 2.6.3 creates a MoodleMobile web-service token with an infinite lifetime, which makes it easier for remote attackers to hijack sessions via a brute-force attack...

PT-2014-3538

Name of the Vulnerable Software and Affected Versions Moodle versions 2.3.11 and earlier, 2.4.x before 2.4.10, 2.5.x before 2.5.6, 2.6.x before 2.6.3 Description The issue allows remote attackers to hijack sessions via a brute-force attack because login/token.php creates a MoodleMobile web-servic...