CVE Vulnerabilities

CVE-2014-3552

Improper Authentication

Published: Jul 29, 2014 | Modified: Dec 01, 2020
CVSS 3.x
N/A
Source:
NVD
CVSS 2.x
6 MEDIUM
AV:N/AC:M/Au:S/C:P/I:P/A:P
RedHat/V2
RedHat/V3
Ubuntu

The Shibboleth authentication plugin in auth/shibboleth/index.php in Moodle through 2.3.11, 2.4.x before 2.4.11, and 2.5.x before 2.5.7 does not check whether a session ID is empty, which allows remote authenticated users to hijack sessions via crafted plugin interaction.

Weakness

When an actor claims to have a given identity, the product does not prove or insufficiently proves that the claim is correct.

Affected Software

Name Vendor Start Version End Version
Moodle Moodle 2.4.3 2.4.3
Moodle Moodle 2.4.1 2.4.1
Moodle Moodle 2.4.9 2.4.9
Moodle Moodle 2.4.2 2.4.2
Moodle Moodle 2.4.6 2.4.6
Moodle Moodle 2.4.4 2.4.4
Moodle Moodle 2.4.7 2.4.7
Moodle Moodle 2.4.5 2.4.5
Moodle Moodle 2.4.8 2.4.8
Moodle Moodle 2.4.10 2.4.10
Moodle Moodle 2.4.0 2.4.0

Potential Mitigations

References