CVE-2015-2272: Moodle - Bypass Forced Password Change
Summary
CVE-2015-2272: Moodle allows attackers to bypass a forced-password-change requirement. Affects moodle/moodle across 3 version ranges.
< 2.6.9
>= 2.7.0, < 2.7.6
>= 2.8.0, < 2.8.4
Fixed in 2.6.9, 2.7.6 or 2.8.4, depending on the release line you run. How to fix ↓
Check if this vulnerability affects your application
Upload a manifest or SBOM and we'll show whether you're affected, plus every other risky package in the same scan.
No signup required · Results in about 60 seconds
Background
Moodle is an open-source learning management system (LMS) used by educational institutions worldwide. It provides a platform for creating and managing online courses, allowing educators to deliver content, interact with students, and assess their progress. Moodle is written in PHP and utilizes a modular architecture, enabling the addition of various plugins and extensions to enhance its functionality. However, a vulnerability has been discovered in Moodle versions 2.5.9 to 2.8.4 that allows remote authenticated users to bypass a forced-password-change requirement.
Vulnerability Detail
The vulnerability, identified as CVE-2015-2272, resides in the 'login/token.php' file of Moodle. This file is responsible for generating web-services tokens used for authentication. By exploiting this vulnerability, an attacker with remote authenticated access can create a web-services token, effectively bypassing the forced-password-change requirement. This means that even if a user is prompted to change their password, they can circumvent this security measure and continue using their old password. The impact of this vulnerability is that an attacker can maintain unauthorized access to the Moodle system, potentially compromising sensitive data and resources.
How To Fix
Fixed versions by release line
The minimum fixed version depends on the release line you run.
-
< 2.6.92.6.9composer require moodle/moodle:2.6.9 -
>= 2.7.0, < 2.7.62.7.6composer require moodle/moodle:2.7.6 -
>= 2.8.0, < 2.8.42.8.4composer require moodle/moodle:2.8.4
Tip — Not sure which release line you're on? Vulert can find the fix for the version you are using. Scan free →
Workaround
There is no specific workaround mentioned for this vulnerability. It is crucial to apply the recommended fix by upgrading to the patched versions of Moodle.
Conclusion
The vulnerability in Moodle versions 2.5.9 to 2.8.4 allows remote authenticated users to bypass a forced-password-change requirement. To mitigate this issue, it is crucial to upgrade to the patched versions of Moodle: 2.6.9, 2.7.6, or 2.8.4. By doing so, you can ensure the security of your Moodle installation and protect sensitive data. For further support on vulnerability remediation, please contact DevNack.com.
See every vulnerability recorded for moodle/moodle →
FAQ
Moodle is an open-source learning management system (LMS) used by educational institutions to create and manage online courses.
The vulnerability allows remote authenticated users to bypass a forced-password-change requirement, potentially compromising the security of the Moodle system and its data.
To fix this vulnerability, upgrade to one of the patched versions of Moodle: 2.6.9, 2.7.6, or 2.8.4.
No specific workaround is mentioned for this vulnerability. Upgrading to the patched versions is the recommended solution.
You can find more information about this vulnerability in the CVE-2015-2272 advisory and the provided sources.
References
Related vulnerabilities
Recent vulnerabilities recorded for moodle/moodle.
