Description

The generate_password function in Moodle through 2.4.11, 2.5.x before 2.5.9, 2.6.x before 2.6.6, and 2.7.x before 2.7.3 does not provide a sufficient number of possible temporary passwords, which allows remote attackers to obtain access via a brute-force attack.

Remediation

References

CVE-2014-7845

Related Vulnerabilities

WordPress Plugin Answer My Question Multiple Cross-Site Scripting Vulnerabilities (1.1)

WordPress URL Redirection to Untrusted Site ('Open Redirect') Vulnerability (CVE-2019-16220)

WordPress Plugin JH 404 Logger Cross-Site Scripting (1.1)

Liferay Portal Improper Neutralization of Input During Web Page Generation ('Cross-site Scripting') Vulnerability (CVE-2011-1570)

XWiki Incorrect Authorization Vulnerability (CVE-2024-38369)

Severity

High

Classification

CVE-2014-7845

Tags

Missing Update Known Vulnerabilities