PT-2015-1610

CVE-2015-0218

Published

2015-01-20

Updated

2022-05-13

Description by

CVSS 2.0

6.8

Medium

MetricsAV:N/AC:M/Au:N/C:P/I:P/A:P

Name of the Vulnerable Software and Affected Versions Moodle versions prior to 2.5.10 Moodle versions 2.6.x through 2.6.6 Moodle versions 2.7.x through 2.7.3 Moodle versions 2.8.x through 2.8.1

Description The issue is related to a cross-site request forgery (CSRF) vulnerability in the auth/shibboleth/logout.php component of the Moodle learning management system. This vulnerability can be exploited by a remote attacker to disrupt the authentication procedure for arbitrary users by using specially crafted requests.

Recommendations For Moodle versions prior to 2.5.10, update to version 2.5.10 or later. For Moodle versions 2.6.x through 2.6.6, update to version 2.6.7 or later. For Moodle versions 2.7.x through 2.7.3, update to version 2.7.4 or later. For Moodle versions 2.8.x through 2.8.1, update to version 2.8.2 or later.

Exploitability

Fix

Impacts

Researchers

Vendors

Affected products

Weakness enumeration

CWE-352: Cross-Site Request Forgery (CSRF)

Related identifiers

CVE-2015-0218

BDU:2015-10943

GHSA-5JPH-MVFM-R27P