CVE-2014-7845 Moodle Temporary Passwords are Brute Force-able
Remote attackers can brute-force temporary passwords due to insufficient entropy in Moodle's password generation, leading to unauthorized account access.
- Exploited in the wild
- Not known
- Login needed
- Not needed
- Attackable
- Over the internet
- Victim action needed
- Not needed
- Fix
- Available
What is CVE-2014-7845?
CVE-2014-7845 is a high-severity vulnerability in Moodle Moodle, published on 24 Nov 2014. An attacker can exploit it over the internet without logging in, with no action from the victim.
Official description
The generate_password function in Moodle through 2.4.11, 2.5.x before 2.5.9, 2.6.x before 2.6.6, and 2.7.x before 2.7.3 does not provide a sufficient number of possible temporary passwords, which allows remote attackers to obtain access via a brute-force attack.
Weakness: CWE-255
Which versions are affected by CVE-2014-7845?
6 open source packages ship an affected version, including moodle/moodle. It affects 1 product.
| Package | Affected | Fixed in |
|---|---|---|
moodle/moodle Packagist | From 2.5.0 | 2.5.9 |
moodle/moodle Packagist | From 2.5.0 | 2.5.9 |
moodle/moodle Packagist | From 2.6.0 | 2.6.6 |
moodle/moodle Packagist | From 2.6.0 | 2.6.6 |
moodle/moodle Packagist | From 2.7.0 | 2.7.3 |
moodle/moodle Packagist | From 2.7.0 | 2.7.3 |
Products include Moodle Moodle.
How do I fix CVE-2014-7845?
Upgrade moodle/moodle to a fixed version for your release line: 2.5.9, 2.6.6 or 2.7.3.
Is CVE-2014-7845 being exploited?
There is no known exploitation of CVE-2014-7845 in the wild and no public exploit code.
Other vulnerabilities in Moodle Moodle
- CVE-2006-4935 File upload in n/a
- CVE-2006-4936 Moodle does not properly validate module instance id
- CVE-2004-2233 Unknown "front page vulnerability with Moodle servers" for Moodle before 1.3.2 has unknown impact and attack vectors.
- CVE-2004-2235 Cross-site scripting in n/a
- CVE-2004-2236 Other in n/a
Sources
Also known as GHSA-9v64-447r-wch6.