Staging Environment: Content and features may be unstable or change without notice.
Advisory details: github_osv / GHSA-5659-g9p4-354f
Advisory ID github_osv/GHSA-5659-g9p4-354f
Aliases CVE-2015-2272
Summary Moodle allows attackers to bypass a forced-password-change requirement login/token.php in Moodle through 2.5.9, 2.6.x before 2.6.9, 2.7.x before 2.7.6, and 2.8.x before 2.8.4 allows remote authenticated users to bypass a forced-password-change requirement by creating a web-services token.
Status Published
Exploitability 0.5
Weighted Severity 0.0
Risk
Affected and Fixed Packages Package Details
Introduced and Fixed Package Commit Patches Package Commit Patches Details
Weaknesses (0)
There are no known CWE.
System Score Found at
generic_textual MODERATE
Reference id Reference type URL
http://git.moodle.org/gw?p=moodle.git&a=search&h=HEAD&st=commit&s=MDL-48691
https://github.com/moodle/moodle
https://github.com/moodle/moodle/commit/0899c0adc036e34e0c37ea1a8d3551610cdb4233
https://github.com/moodle/moodle/commit/6e284d55b234287169f21e6ef8a9a237d6eedfe4
https://github.com/moodle/moodle/commit/b0abcbda170b57649e0ed39ac5aca91dbc30337f
https://moodle.org/mod/forum/discuss.php?d=307386
https://web.archive.org/web/20200227182455/http://www.securityfocus.com/bid/73166
http://www.securityfocus.com/bid/73166
CVE-2015-2272 https://nvd.nist.gov/vuln/detail/CVE-2015-2272
No exploits are available.

No EPSS data available for this advisory.

Patch URL
There are no known patches.
There are no known vectors.

There are no SSVC decisions available.