Description

The Shibboleth authentication plugin in auth/shibboleth/index.php in Moodle through 2.3.11, 2.4.x before 2.4.11, and 2.5.x before 2.5.7 does not check whether a session ID is empty, which allows remote authenticated users to hijack sessions via crafted plugin interaction.

Remediation

References

CVE-2014-3552

Related Vulnerabilities

GlassFish CVE-2017-10391 Vulnerability (CVE-2017-10391)

Python Integer Overflow or Wraparound Vulnerability (CVE-2017-1000158)

WordPress Plugin YITH WooCommerce Best Sellers Security Bypass (1.1.11)

WordPress Plugin Ultimate Reviews PHP Object Injection (2.0.18)

WordPress CVE-2016-5839 Vulnerability (CVE-2016-5839)

Severity

Medium

Classification

CVE-2014-3552 CWE-287

Tags

Missing Update Known Vulnerabilities