Unscored severity · published Jan 20, 2014
CVE-2014-0010
Multiple cross-site request forgery (CSRF) vulnerabilities in user/profile/index.php in Moodle through 2.2.11, 2.3.x before 2.3.11, 2.4.x before 2.4.8, 2.5.x before 2.5.4, and…
–
CVSS
1.1%
EPSS
No
On KEV
Description
Multiple cross-site request forgery (CSRF) vulnerabilities in user/profile/index.php in Moodle through 2.2.11, 2.3.x before 2.3.11, 2.4.x before 2.4.8, 2.5.x before 2.5.4, and 2.6.x before 2.6.1 allow remote attackers to hijack the authentication of administrators for requests that delete (1) categories or (2) fields.
Exploitation
Is it being used?
Exploit prediction (EPSS)1.1% · higher than 65% of CVEs
Exploited in the wildNo evidence yet
CISA KEVNot listed
Ransomware campaign useNot known
Affected products
Which versions
FE
Fedora · Fedoraproject
19; 20 · source: NVD
MO
Moodle · Moodle
2.4.0; 2.4.1; 2.4.2; 2.4.3; 2.4.4; 2.4.5; +34 more · source: NVD
References
NVD
https://nvd.nist.gov/vuln/detail/CVE-2014-0010
CVE.org
https://www.cve.org/CVERecord?id=CVE-2014-0010
Patch
http://git.moodle.org/gw?p=moodle.git&a=search&h=HEAD&st=commit&s=MDL-42883
lists.fedoraproject.org
http://lists.fedoraproject.org/pipermail/package-announce/2014-January/127510.html
lists.fedoraproject.org
http://lists.fedoraproject.org/pipermail/package-announce/2014-January/127533.html
openwall.com
http://openwall.com/lists/oss-security/2014/01/20/1
osvdb.org
http://osvdb.org/102261
www.securitytracker.com
http://www.securitytracker.com/id/1029649
More from Fedora
10.0
CVE-2021-44228
Apache Log4j2 JNDI features do not protect against attacker controlled LDAP and other JNDI related endpoints
10.0
CVE-2015-3306
ProFTPD Improper Access Control Vulnerability
9.8
CVE-2024-4577
Argument Injection in PHP-CGI
9.8
CVE-2021-44026
Roundcube Webmail SQL Injection Vulnerability
9.8
CVE-2021-42013
Path Traversal and Remote Code Execution in Apache HTTP Server 2.4.49 and 2.4.50 (incomplete fix of CVE-2021-41773)