CVE-2014-0125: Medium severity Moodle moodle vulnerability
repository/alfresco/lib.php in Moodle through 2.3.11, 2.4.x before 2.4.9, 2.5.x before 2.5.5, and 2.6.x before 2.6.2 places a session key in a URL, which allows remote attackers to bypass intended Alfresco Repository file restrictions by impersonating a file's owner.
Affected Software
Remediation
Recommended actions to resolve this vulnerability, in priority order.
- Upgrade
Upgrade
composer/moodle/moodleto a version that resolves this vulnerability.Fixed in 2.6.2 - Upgrade
Upgrade
composer/moodle/moodleto a version that resolves this vulnerability.Fixed in 2.5.5 - Upgrade
Upgrade
composer/moodle/moodleto a version that resolves this vulnerability.Fixed in 2.4.9 - Upgrade
Upgrade
moodle/repository/alfresco/lib.phpto a version that resolves this vulnerability.Fixed in 2.4.9 - Upgrade
Upgrade
moodle/repository/alfresco/lib.phpto a version that resolves this vulnerability.Fixed in 2.5.5 - Upgrade
Upgrade
moodle/repository/alfresco/lib.phpto a version that resolves this vulnerability.Fixed in 2.6.2 - Upgrade
Upgrade
moodle/repository/alfresco/lib.phpto a version that resolves this vulnerability.Fixed in 2.3.11
Event History
Frequently Asked Questions
What is the severity of CVE-2014-0125?
CVE-2014-0125 has a medium severity level as it allows remote attackers to bypass file restrictions.
How do I fix CVE-2014-0125?
To fix CVE-2014-0125, upgrade to Moodle version 2.6.2, 2.5.5, or 2.4.9 or later.
Which versions of Moodle are affected by CVE-2014-0125?
CVE-2014-0125 affects Moodle versions 2.3.11 and earlier, all versions of 2.4 before 2.4.9, 2.5 before 2.5.5, and 2.6 before 2.6.2.
What type of vulnerability is CVE-2014-0125?
CVE-2014-0125 is a security vulnerability that involves session management, allowing impersonation of file owners.
Can CVE-2014-0125 result in unauthorized access to files?
Yes, CVE-2014-0125 allows attackers to access files by impersonating the owner due to session key exposure in URLs.