CVE-2007-1647

Published Mar 24, 2007

Last updated 7 years ago

Overview

Description: Moodle 1.5.2 and earlier stores sensitive information under the web root with insufficient access control, and provides directory listings, which allows remote attackers to obtain user names, password hashes, and other sensitive information via a direct request for session (sess_*) files in moodledata/sessions/.
Source: cve@mitre.org
NVD status: Modified

Risk scores

CVSS 2.0

Type: Primary
Base score: 7.8
Impact score: 6.9
Exploitability score: 10
Vector string: AV:N/AC:L/Au:N/C:C/I:N/A:N

Weaknesses

nvd@nist.gov: NVD-CWE-Other

Hype score: Not currently trending

Configurations

[
  {
    "nodes": [
      {
        "negate": false,
        "cpeMatch": [
          {
            "criteria": "cpe:2.3:a:moodle:moodle:*:*:*:*:*:*:*:*",
            "vulnerable": true,
            "matchCriteriaId": "A3F1A828-0A58-43E2-9C9F-04D488084D11",
            "versionEndIncluding": "1.5.2"
          }
        ],
        "operator": "OR"
      }
    ]
  }
]

References