CVE-2014-7847: Moodle allows attackers to cause a denial of service
iplookup/index.php in Moodle through 2.4.11, 2.5.x before 2.5.9, 2.6.x before 2.6.6, and 2.7.x before 2.7.3 allows remote attackers to cause a denial of service (resource consumption) by triggering the calculation of an estimated latitude and longitude for an IP address.
Other sources
Moodle allows attackers to cause a denial of service
— Packagist
Affected Software
Remediation
Recommended actions to resolve this vulnerability, in priority order.
- Upgrade
Upgrade
composer/moodle/moodleto a version that resolves this vulnerability.Fixed in 2.7.3 - Upgrade
Upgrade
composer/moodle/moodleto a version that resolves this vulnerability.Fixed in 2.6.6 - Upgrade
Upgrade
composer/moodle/moodleto a version that resolves this vulnerability.Fixed in 2.5.9
Event History
Frequently Asked Questions
What is the severity of CVE-2014-7847?
CVE-2014-7847 is rated as a medium severity vulnerability due to its potential for denial of service.
How do I fix CVE-2014-7847?
To fix CVE-2014-7847, upgrade Moodle to version 2.5.9, 2.6.6, or 2.7.3 or later.
What versions of Moodle are affected by CVE-2014-7847?
Versions of Moodle affected by CVE-2014-7847 include 2.4.11 and earlier, 2.5.x before 2.5.9, 2.6.x before 2.6.6, and 2.7.x before 2.7.3.
What kind of attack can exploit CVE-2014-7847?
CVE-2014-7847 allows remote attackers to exploit the vulnerability to cause a denial of service by consuming server resources.
Is there a workaround for CVE-2014-7847?
There is no specific workaround for CVE-2014-7847; the best course of action is to upgrade to a patched version of Moodle.