CVE-2015-2272: Moodle allows attackers to bypass a forced-password-change requirement
login/token.php in Moodle through 2.5.9, 2.6.x before 2.6.9, 2.7.x before 2.7.6, and 2.8.x before 2.8.4 allows remote authenticated users to bypass a forced-password-change requirement by creating a web-services token.
Other sources
Moodle allows attackers to bypass a forced-password-change requirement
— Packagist
Affected Software
Remediation
Recommended actions to resolve this vulnerability, in priority order.
- Upgrade
Upgrade
composer/moodle/moodleto a version that resolves this vulnerability.Fixed in 2.8.4 - Upgrade
Upgrade
composer/moodle/moodleto a version that resolves this vulnerability.Fixed in 2.7.6 - Upgrade
Upgrade
composer/moodle/moodleto a version that resolves this vulnerability.Fixed in 2.6.9
Event History
Frequently Asked Questions
What is the severity of CVE-2015-2272?
CVE-2015-2272 has been rated as a medium severity vulnerability due to its potential for allowing unauthorized access to users.
How do I fix CVE-2015-2272?
To remediate CVE-2015-2272, upgrade Moodle to version 2.8.4, 2.7.6, or 2.6.9 or later.
Which versions of Moodle are affected by CVE-2015-2272?
CVE-2015-2272 affects Moodle versions prior to 2.5.10, 2.6.9, 2.7.6, and 2.8.4.
What does CVE-2015-2272 allow an attacker to do?
CVE-2015-2272 allows remote authenticated users to bypass forced password change requirements by creating a web services token.
Is it possible to exploit CVE-2015-2272 without authentication?
No, exploitation of CVE-2015-2272 requires prior authentication to the Moodle system.