CVE-2014-0008
First published: Mon Jan 20 2014(Updated: )
lib/adminlib.php in Moodle through 2.3.11, 2.4.x before 2.4.8, 2.5.x before 2.5.4, and 2.6.x before 2.6.1 logs cleartext passwords, which allows remote authenticated administrators to obtain sensitive information by reading the Config Changes Report.
Credit: secalert@redhat.com
| Affected Software | Affected Version | How to fix |
|---|---|---|
| Moodle | =2.5.0 | |
| Moodle | =2.5.1 | |
| Moodle | =2.5.2 | |
| Moodle | =2.5.3 | |
| Moodle | =2.6.0 | |
| Moodle | =2.4.0 | |
| Moodle | =2.4.1 | |
| Moodle | =2.4.2 | |
| Moodle | =2.4.3 | |
| Moodle | =2.4.4 | |
| Moodle | =2.4.5 | |
| Moodle | =2.4.6 | |
| Moodle | =2.4.7 | |
| Moodle | <=2.3.11 | |
| Moodle | =2.3.0 | |
| Moodle | =2.3.1 | |
| Moodle | =2.3.2 | |
| Moodle | =2.3.3 | |
| Moodle | =2.3.4 | |
| Moodle | =2.3.5 | |
| Moodle | =2.3.6 | |
| Moodle | =2.3.7 | |
| Moodle | =2.3.8 | |
| Moodle | =2.3.9 | |
| Moodle | =2.3.10 |
Never miss a vulnerability like this again
Sign up to SecAlerts for real-time vulnerability data matched to your software, aggregated from hundreds of sources.
Reference Links
- http://git.moodle.org/gw?p=moodle.git&a=search&h=HEAD&st=commit&s=MDL-36721
- http://lists.fedoraproject.org/pipermail/package-announce/2014-January/127510.html
- http://lists.fedoraproject.org/pipermail/package-announce/2014-January/127533.html
- http://openwall.com/lists/oss-security/2014/01/20/1
- http://www.securitytracker.com/id/1029647
- https://moodle.org/mod/forum/discuss.php?d=252414
Frequently Asked Questions
What is the severity of CVE-2014-0008?
CVE-2014-0008 has a high severity rating due to the exposure of cleartext passwords in logs.
How do I fix CVE-2014-0008?
To fix CVE-2014-0008, upgrade to Moodle version 2.4.8, 2.5.4, 2.6.1 or later.
What versions of Moodle are affected by CVE-2014-0008?
CVE-2014-0008 affects Moodle versions 2.3.11 and earlier, and 2.4.x through 2.4.7, 2.5.x through 2.5.3, and 2.6.x through 2.6.0.
What types of information can be leaked due to CVE-2014-0008?
CVE-2014-0008 can lead to leaks of sensitive information including cleartext passwords accessible in the Config Changes Report.
Who is at risk due to CVE-2014-0008?
Remote authenticated administrators can exploit CVE-2014-0008 to access sensitive information in Moodle.
- agent/references
- agent/type
- agent/softwarecombine
- agent/remedy
- collector/mitre-cve
- source/MITRE
- agent/weakness
- agent/author
- agent/severity
- agent/last-modified-date
- agent/first-publish-date
- agent/event
- agent/description
- agent/source
- agent/tags
- collector/nvd-index
- agent/software-canonical-lookup-request
- vendor/moodle
- canonical/moodle
- version/moodle/2.5.0
- version/moodle/2.5.1
- version/moodle/2.5.2
- version/moodle/2.5.3
- version/moodle/2.6.0
- version/moodle/2.4.0
- version/moodle/2.4.1
- version/moodle/2.4.2
- version/moodle/2.4.3
- version/moodle/2.4.4
- version/moodle/2.4.5
- version/moodle/2.4.6
- version/moodle/2.4.7
- version/moodle/2.3.11
- version/moodle/2.3.0
- version/moodle/2.3.1
- version/moodle/2.3.2
- version/moodle/2.3.3
- version/moodle/2.3.4
- version/moodle/2.3.5
- version/moodle/2.3.6
- version/moodle/2.3.7
- version/moodle/2.3.8
- version/moodle/2.3.9
- version/moodle/2.3.10