CVE-2007-1647: High severity Moodle moodle vulnerability
Moodle 1.5.2 and earlier stores sensitive information under the web root with insufficient access control, and provides directory listings, which allows remote attackers to obtain user names, password hashes, and other sensitive information via a direct request for session (sess) files in moodledata/sessions/.
Affected Software
Event History
Frequently Asked Questions
What is the severity of CVE-2007-1647?
CVE-2007-1647 has a medium severity due to its potential for exposing sensitive user information.
How do I fix CVE-2007-1647?
To fix CVE-2007-1647, upgrade Moodle to version 1.5.3 or later to implement proper access controls.
What types of information can be accessed due to CVE-2007-1647?
CVE-2007-1647 allows attackers to access sensitive information such as usernames and password hashes through direct requests for session files.
Which versions of Moodle are affected by CVE-2007-1647?
CVE-2007-1647 affects Moodle version 1.5.2 and earlier.
How can I determine if my Moodle installation is impacted by CVE-2007-1647?
To determine if your Moodle installation is impacted by CVE-2007-1647, check if you are using Moodle version 1.5.2 or earlier and review your access controls.