CVE-2014-0008

Severity: medium (CVSS 4.0 v2.0)
Exploited in the wild: not listed in CISA KEV
EPSS: 1.8% probability of exploitation in the next 30 days
Public exploit or detection template: none known
Published: 2014-01-20 · updated 2026-06-17
Weakness: CWE-255

Description

lib/adminlib.php in Moodle through 2.3.11, 2.4.x before 2.4.8, 2.5.x before 2.5.4, and 2.6.x before 2.6.1 logs cleartext passwords, which allows remote authenticated administrators to obtain sensitive information by reading the Config Changes Report.

Affected products

Moodle: through 2.3.11; 2.5.0, 2.5.1, 2.5.2, 2.5.3, 2.6.0, 2.4.0 (+18)

References

http://git.moodle.org/gw?p=moodle.git&a=search&h=HEAD&st=commit&s=MDL-36721
http://lists.fedoraproject.org/pipermail/package-announce/2014-January/127510.html
http://lists.fedoraproject.org/pipermail/package-announce/2014-January/127533.html
http://openwall.com/lists/oss-security/2014/01/20/1
http://www.securitytracker.com/id/1029647
https://moodle.org/mod/forum/discuss.php?d=252414
http://git.moodle.org/gw?p=moodle.git&a=search&h=HEAD&st=commit&s=MDL-36721
http://lists.fedoraproject.org/pipermail/package-announce/2014-January/127510.html
http://lists.fedoraproject.org/pipermail/package-announce/2014-January/127533.html
http://openwall.com/lists/oss-security/2014/01/20/1
http://www.securitytracker.com/id/1029647
https://moodle.org/mod/forum/discuss.php?d=252414

Get alerted when CVE-2014-0008 or the next vulnerability affects your stack