CVSS Meta Temp Score | Current Exploit Price (≈) | CTI Interest Score |
---|---|---|
6.0 | $0-$5k | 0.00 |
A vulnerability was found in Moodle (Learning Management Software). It has been classified as critical. Affected is an unknown code. The manipulation with an unknown input leads to a improper authentication vulnerability. CWE is classifying the issue as CWE-287. When an actor claims to have a given identity, the product does not prove or insufficiently proves that the claim is correct. This is going to have an impact on confidentiality, integrity, and availability. CVE summarizes:
The Shibboleth authentication plugin in auth/shibboleth/index.php in Moodle through 2.3.11, 2.4.x before 2.4.11, and 2.5.x before 2.5.7 does not check whether a session ID is empty, which allows remote authenticated users to hijack sessions via crafted plugin interaction.
The weakness was shared 07/29/2014 by Colin as confirmed git commit (GIT Repository). The advisory is available at git.moodle.org. This vulnerability is traded as CVE-2014-3552 since 05/14/2014. It is possible to launch the attack remotely. A authentication is needed for exploitation. The technical details are unknown and an exploit is not available.
The commercial vulnerability scanner Qualys is able to test this issue with plugin 122523 (Fedora Security Update for moodle (FEDORA-2014-8609)).
Applying a patch is able to eliminate this problem. The bugfix is ready for download at git.moodle.org.
The vulnerability is also documented in the vulnerability database at X-Force (94735). The entries 70495, 70493, 70490 and 70489 are related to this item.
Product
Type
Name
Version
- 2.3
- 2.3.1
- 2.3.2
- 2.3.3
- 2.3.4
- 2.3.5
- 2.3.6
- 2.3.7
- 2.3.8
- 2.3.9
- 2.3.10
- 2.3.11
- 2.4
- 2.4.1
- 2.4.2
- 2.4.3
- 2.4.4
- 2.4.5
- 2.4.6
- 2.4.7
- 2.4.8
- 2.4.9
- 2.4.10
- 2.5
- 2.5.1
- 2.5.2
- 2.5.3
- 2.5.4
- 2.5.5
- 2.5.6
License
CPE 2.3
CPE 2.2
CVSSv4
VulDB CVSS-B Score: 🔍VulDB CVSS-BT Score: 🔍
VulDB Vector: 🔍
VulDB Reliability: 🔍
CVSSv3
VulDB Meta Base Score: 6.3VulDB Meta Temp Score: 6.0
VulDB Base Score: 6.3
VulDB Temp Score: 6.0
VulDB Vector: 🔍
VulDB Reliability: 🔍
CVSSv2
AV | AC | Au | C | I | A |
---|---|---|---|---|---|
💳 | 💳 | 💳 | 💳 | 💳 | 💳 |
💳 | 💳 | 💳 | 💳 | 💳 | 💳 |
💳 | 💳 | 💳 | 💳 | 💳 | 💳 |
Vector | Complexity | Authentication | Confidentiality | Integrity | Availability |
---|---|---|---|---|---|
unlock | unlock | unlock | unlock | unlock | unlock |
unlock | unlock | unlock | unlock | unlock | unlock |
unlock | unlock | unlock | unlock | unlock | unlock |
VulDB Base Score: 🔍
VulDB Temp Score: 🔍
VulDB Reliability: 🔍
NVD Base Score: 🔍
Exploiting
Class: Improper authenticationCWE: CWE-287
ATT&CK: Unknown
Local: No
Remote: Yes
Availability: 🔍
Status: Not defined
EPSS Score: 🔍
EPSS Percentile: 🔍
Price Prediction: 🔍
Current Price Estimation: 🔍
0-Day | unlock | unlock | unlock | unlock |
---|---|---|---|---|
Today | unlock | unlock | unlock | unlock |
OpenVAS ID: 867240
OpenVAS Name: Fedora Update for moodle FEDORA-2014-10802
OpenVAS File: 🔍
OpenVAS Family: 🔍
Qualys ID: 🔍
Qualys Name: 🔍
Threat Intelligence
Interest: 🔍Active Actors: 🔍
Active APT Groups: 🔍
Countermeasures
Recommended: PatchStatus: 🔍
0-Day Time: 🔍
Patch: git.moodle.org
Timeline
05/14/2014 🔍07/21/2014 🔍
07/21/2014 🔍
07/29/2014 🔍
07/29/2014 🔍
08/14/2014 🔍
03/26/2015 🔍
06/04/2017 🔍
Sources
Product: moodle.orgAdvisory: git.moodle.org
Researcher: Colin
Status: Confirmed
Confirmation: 🔍
CVE: CVE-2014-3552 (🔍)
X-Force: 94735
Vulnerability Center: 45858 - Moodle Remote Session Hijacking Vulnerability in Shibboleth Authentication, Medium
SecurityFocus: 68780 - Moodle Shibboleth Plugin CVE-2014-3552 Authentication Bypass Vulnerability
See also: 🔍
Entry
Created: 03/26/2015 12:07Updated: 06/04/2017 10:53
Changes: 03/26/2015 12:07 (64), 06/04/2017 10:53 (4)
Complete: 🔍
No comments yet. Languages: en.
Please log in to comment.