CVE-2014-3552

Moodle < 2.3.11 - Authentication Bypass

Title source: rule

Description

The Shibboleth authentication plugin in auth/shibboleth/index.php in Moodle through 2.3.11, 2.4.x before 2.4.11, and 2.5.x before 2.5.7 does not check whether a session ID is empty, which allows remote authenticated users to hijack sessions via crafted plugin interaction.

References (3)

Scores

EPSS 0.0035
EPSS Percentile 57.3%

Classification

CWE
CWE-287
Status draft

Affected Products (30)

moodle/moodle
moodle/moodle
moodle/moodle
moodle/moodle
moodle/moodle
moodle/moodle
moodle/moodle
moodle/moodle
moodle/moodle
moodle/moodle
moodle/moodle
moodle/moodle < 2.3.11
moodle/moodle
moodle/moodle
moodle/moodle
... and 15 more

Timeline

Published Jul 29, 2014
Tracked Since Feb 18, 2026