CVE-2015-2272

Published: Jun 1, 2015Modified: May 6, 2026

4.0

Vector

AV:N/AC:L/Au:S/C:N/I:P/A:N

Exploitability: 8.0 / Impact: 2.9

Source: NVD

Description

login/token.php in Moodle through 2.5.9, 2.6.x before 2.6.9, 2.7.x before 2.7.6, and 2.8.x before 2.8.4 allows remote authenticated users to bypass a forced-password-change requirement by creating a web-services token.

Affected (29)

Products: Moodle: Moodle

Moodle

1 product

Moodle

Configuration A

29 vulnerable

Vulnerable Software	Affected Versions
Moodle Moodle	Up to 2.5.9
Moodle Moodle	Version 2.5.0
Moodle Moodle	Version 2.5.1
Moodle Moodle	Version 2.5.2
Moodle Moodle	Version 2.5.3
Moodle Moodle	Version 2.5.4
Moodle Moodle	Version 2.5.5
Moodle Moodle	Version 2.5.6
Moodle Moodle	Version 2.5.7
Moodle Moodle	Version 2.5.8
Moodle Moodle	Version 2.6.0
Moodle Moodle	Version 2.6.1
Moodle Moodle	Version 2.6.2
Moodle Moodle	Version 2.6.3
Moodle Moodle	Version 2.6.4
Moodle Moodle	Version 2.6.5
Moodle Moodle	Version 2.6.6
Moodle Moodle	Version 2.6.7
Moodle Moodle	Version 2.6.8
Moodle Moodle	Version 2.7.0
Moodle Moodle	Version 2.7.1
Moodle Moodle	Version 2.7.2
Moodle Moodle	Version 2.7.3
Moodle Moodle	Version 2.7.4
Moodle Moodle	Version 2.7.5
Moodle Moodle	Version 2.8.0
Moodle Moodle	Version 2.8.1
Moodle Moodle	Version 2.8.2
Moodle Moodle	Version 2.8.3