CVE-2015-5267: Infoleak
lib/moodlelib.php in Moodle through 2.6.11, 2.7.x before 2.7.10, 2.8.x before 2.8.8, and 2.9.x before 2.9.2 relies on the PHP mtrand function to implement the randomstring and complexrandomstring functions, which makes it easier for remote attackers to predict password-recovery tokens via a brute-force approach.
Affected Software
Event History
Frequently Asked Questions
What is the severity of CVE-2015-5267?
CVE-2015-5267 is considered a medium severity vulnerability due to its potential for leading to predictable password-recovery tokens.
How do I fix CVE-2015-5267?
To fix CVE-2015-5267, you should upgrade to Moodle version 2.7.10, 2.8.8, or 2.9.2 or later.
Which versions of Moodle are affected by CVE-2015-5267?
Affected versions include Moodle up to and including 2.6.11, as well as 2.7.x before 2.7.10, 2.8.x before 2.8.8, and 2.9.x before 2.9.2.
What function is exploited in CVE-2015-5267?
CVE-2015-5267 exploits the reliance on the PHP mt_rand function within the random_string and complex_random_string functions.
What is the impact of CVE-2015-5267?
The impact of CVE-2015-5267 allows remote attackers to predict password-recovery tokens, potentially compromising user accounts.