CVE-2015-2272 in Moodle
Summary
by MITRE
login/token.php in Moodle through 2.5.9, 2.6.x before 2.6.9, 2.7.x before 2.7.6, and 2.8.x before 2.8.4 allows remote authenticated users to bypass a forced-password-change requirement by creating a web-services token.
If you want to get best quality of vulnerability data, you may have to visit VulDB.
Analysis
by VulDB Data Team • 05/19/2022
The vulnerability identified as CVE-2015-2272 affects Moodle learning management systems across multiple versions including 2.5.9 and earlier, 2.6.x versions before 2.6.9, 2.7.x versions before 2.7.6, and 2.8.x versions before 2.8.4. This security flaw resides within the login/token.php component of the platform, specifically targeting the authentication and authorization mechanisms that govern user access and password policies. The vulnerability represents a critical weakness in the system's security architecture that undermines the integrity of mandatory password change requirements.
The technical implementation of this vulnerability stems from insufficient validation within the web services token creation process. When authenticated users attempt to create web services tokens through the login/token.php endpoint, the system fails to properly verify whether the user account has a mandatory password change requirement. This oversight allows attackers to circumvent the intended security control that forces users to change their passwords upon login or after specific policy triggers. The flaw operates at the intersection of authentication and authorization controls, where the token creation process does not perform the necessary checks to ensure compliance with password policies.
The operational impact of this vulnerability extends beyond simple privilege escalation to compromise the overall security posture of Moodle installations. Attackers can exploit this weakness to maintain persistent access to user accounts that should have been restricted due to mandatory password changes, potentially leading to unauthorized data access, modification, or exfiltration. The vulnerability undermines the principle of least privilege and could enable attackers to perform actions within the system that would otherwise be restricted. This poses significant risks to educational institutions and organizations relying on Moodle for their learning management needs.
Organizations should implement immediate mitigations including updating to patched versions of Moodle as specified in the CVE references, disabling unnecessary web services tokens for users requiring password changes, and implementing additional monitoring of token creation activities. The vulnerability aligns with CWE-693, which addresses protection mechanism failures, and represents a specific instance of inadequate access control validation. From an ATT&CK framework perspective, this vulnerability maps to privilege escalation techniques and credential access phases, where adversaries can maintain access despite security controls designed to restrict their activities. System administrators should also consider implementing network-based monitoring solutions to detect anomalous token creation patterns that might indicate exploitation attempts.