CVE-2014-0008: Medium severity Moodle moodle vulnerability
lib/adminlib.php in Moodle through 2.3.11, 2.4.x before 2.4.8, 2.5.x before 2.5.4, and 2.6.x before 2.6.1 logs cleartext passwords, which allows remote authenticated administrators to obtain sensitive information by reading the Config Changes Report.
Affected Software
Remediation
Recommended actions to resolve this vulnerability, in priority order.
- Upgrade
Upgrade
Moodle lib/adminlib.phpto a version that resolves this vulnerability.Fixed in 2.4.8 - Upgrade
Upgrade
Moodle lib/adminlib.phpto a version that resolves this vulnerability.Fixed in 2.5.4 - Upgrade
Upgrade
Moodle lib/adminlib.phpto a version that resolves this vulnerability.Fixed in 2.6.1 - Upgrade
Upgrade
Moodle lib/adminlib.phpto a version that resolves this vulnerability.Fixed in 2.3.11
Event History
Frequently Asked Questions
What is the severity of CVE-2014-0008?
CVE-2014-0008 has a high severity rating due to the exposure of cleartext passwords in logs.
How do I fix CVE-2014-0008?
To fix CVE-2014-0008, upgrade to Moodle version 2.4.8, 2.5.4, 2.6.1 or later.
What versions of Moodle are affected by CVE-2014-0008?
CVE-2014-0008 affects Moodle versions 2.3.11 and earlier, and 2.4.x through 2.4.7, 2.5.x through 2.5.3, and 2.6.x through 2.6.0.
What types of information can be leaked due to CVE-2014-0008?
CVE-2014-0008 can lead to leaks of sensitive information including cleartext passwords accessible in the Config Changes Report.
Who is at risk due to CVE-2014-0008?
Remote authenticated administrators can exploit CVE-2014-0008 to access sensitive information in Moodle.