NVD

Id
31730  
Name
CVE-2014-3552  
Description
The Shibboleth authentication plugin in auth/shibboleth/index.php in Moodle through 2.3.11, 2.4.x before 2.4.11, and 2.5.x before 2.5.7 does not check whether a session ID is empty, which allows remote authenticated users to hijack sessions via crafted plugin interaction.  
Reject
 
CVSS Version
2  
CVSS Score
6  
Severity
Medium  
CVSS Base Score
6  
CVSS Impact Subscore
6.4  
CVSS Exploit Subscore
6.8  
CVSS Vector
(AV:N/AC:M/Au:S/C:P/I:P/A:P)  
Pub Date
2017-01-19  
Published
2014-07-29  
Modified Date
2014-07-29  
Seq
2014-3552  

Actions

Related NVD References

Id NVD Id NVD No. Reference Actions
166706 31730 CVE-2014-3552 http://git.moodle.org/gw?p=moodle.git&a=search&h=refs%2Fheads%2FMOODLE_25_STABLE&st=commit&s=MDL-45485  View
166707 31730 CVE-2014-3552 [oss-security] 20140721 Moodle security notifications public  View
166708 31730 CVE-2014-3552 https://moodle.org/mod/forum/discuss.php?d=264261  View

Related JVN

Id Name Title Summary Cveinfo Name Cveinfo Id Nvdinfo Name Nvdinfo Id Cvssv2 Cvssv3 Jvnurl Published Date Last Updated Date Actions
14746 JVNDB-2014-003621 Moodle の auth/shibboleth/index.php の Shibboleth 認証プラグインにおけるセッションをハイジャックされる脆弱性 Moodle の auth/shibboleth/index.php の Shibboleth 認証プラグインは、セッション ID が空であるかどうかをチェックしないため、セッションをハイジャックされる脆弱性が存在します。 CVE-2014-3552 70840 CVE-2014-3552 31730 6 http://jvndb.jvn.jp/ja/contents/2014/JVNDB-2014-003621.html 2014-07-21 2014-07-30 View