| Package | Affected versions | Patched versions |
|---|---|---|
| moodle/moodle | ≥ 2.8.0, < 2.8.8≥ 2.9.0, < 2.9.2< 2.7.10 | 2.8.82.9.22.7.10 |
| moodle | = 2.7.0= 2.7.1= 2.7.2= 2.7.3= 2.7.4= 2.7.5= 2.7.6= 2.7.7= 2.7.8= 2.7.9= 2.8.0= 2.8.1= 2.8.2= 2.8.3= 2.8.4= 2.8.5= 2.8.6= 2.8.7= 2.9.0= 2.9.1≤ 2.6.11 |
lib/moodlelib.php in Moodle through 2.6.11, 2.7.x before 2.7.10, 2.8.x before 2.8.8, and 2.9.x before 2.9.2 relies on the PHP mt_rand function to implement the random_string and complex_random_string functions, which makes it easier for remote attackers to predict password-recovery tokens via a brute-force approach.
Running one of these products? Scan your site to see whether it exposes a vulnerable version.
Scan my site free