CVE-2015-2272: Medium severity moodle vulnerability
Published Jun 1, 2015
·Updated
login/token.php in Moodle through 2.5.9, 2.6.x before 2.6.9, 2.7.x before 2.7.6, and 2.8.x before 2.8.4 allows remote authenticated users to bypass a forced-password-change requirement by creating a web-services token.
Affected Software
32 affected componentsFixes available
composer/moodle/moodle>=2.8.0<2.8.4
2.8.4
composer/moodle/moodle>=2.7.0<2.7.6
2.7.6
composer/moodle/moodle<2.6.9
2.6.9
Moodle moodle<=2.5.9
Moodle moodle=2.5.0
Moodle moodle=2.5.1
Moodle moodle=2.5.2
Moodle moodle=2.5.3
Moodle moodle=2.5.4
Moodle moodle=2.5.5
Moodle moodle=2.5.6
Moodle moodle=2.5.7
Moodle moodle=2.5.8
Moodle moodle=2.6.0
Moodle moodle=2.6.1
Moodle moodle=2.6.2
Moodle moodle=2.6.3
Moodle moodle=2.6.4
Moodle moodle=2.6.5
Moodle moodle=2.6.6
Moodle moodle=2.6.7
Moodle moodle=2.6.8
Moodle moodle=2.7.0
Moodle moodle=2.7.1
Moodle moodle=2.7.2
Moodle moodle=2.7.3
Moodle moodle=2.7.4
Moodle moodle=2.7.5
Moodle moodle=2.8.0
Moodle moodle=2.8.1
Moodle moodle=2.8.2
Moodle moodle=2.8.3
Event History
Jun 1, 2015
CVE Published
via MITRE·07:00 PM
Data Sourced
via MITRE·07:00 PM
Description
May 13, 2022
Advisory Published
via GitHub·01:12 AM
Frequently Asked Questions
1
What is the severity of CVE-2015-2272?
CVE-2015-2272 has been rated as a medium severity vulnerability due to its potential for allowing unauthorized access to users.
2
How do I fix CVE-2015-2272?
To remediate CVE-2015-2272, upgrade Moodle to version 2.8.4, 2.7.6, or 2.6.9 or later.
3
Which versions of Moodle are affected by CVE-2015-2272?
CVE-2015-2272 affects Moodle versions prior to 2.5.10, 2.6.9, 2.7.6, and 2.8.4.
4
What does CVE-2015-2272 allow an attacker to do?
CVE-2015-2272 allows remote authenticated users to bypass forced password change requirements by creating a web services token.
5
Is it possible to exploit CVE-2015-2272 without authentication?
No, exploitation of CVE-2015-2272 requires prior authentication to the Moodle system.