Every CVESearch/Get API key

CVE-2014-0010

Multiple cross-site request forgery (CSRF) vulnerabilities in user/profile/index.php in Moodle...

6.8 Medium

CVE-2014-0010 is a medium vulnerability (CVSS 6.8) in Moodle, published January 20, 2014. No source lists public exploit code. EPSS puts the chance of exploitation in the next 30 days at 1.09%, the 66th percentile. No source names a fixed version.

What does this mean?
Severity
6.8 MediumCVSS 2.0, NVD
Exploit chance
1.09%EPSS, 66th percentile
Exploitation
None knownNot on CISA’s or ENISA’s lists
Fixed in
No fix listedNo source names one

Description

Multiple cross-site request forgery (CSRF) vulnerabilities in user/profile/index.php in Moodle through 2.2.11, 2.3.x before 2.3.11, 2.4.x before 2.4.8, 2.5.x before 2.5.4, and 2.6.x before 2.6.1 allow remote attackers to hijack the authentication of administrators for requests that delete (1) categories or (2) fields.

Exploit likelihood

1.09%Down 0.2 points since Feb 4, 2022
90%50%10%1%

Affected products

Affected packages

Affected packages
PackageAffectedFixed
moodle
Mageia:3
From an advisory covering 3 CVEs
before 2.4.8-1.mga3
2.4.8-1.mga3
moodle
Mageia:4
From an advisory covering 3 CVEs
before 2.4.8-1.mga4
2.4.8-1.mga4

What each source reports

NVD Score used6.8

Multiple cross-site request forgery (CSRF) vulnerabilities in user/profile/index.php in Moodle through 2.2.11, 2.3.x before 2.3.11, 2.4.x before 2.4.8, 2.5.x before 2.5.4, and 2.6.x before 2.6.1 allow remote attackers to hijack the authentication of administrators for requests that delete (1) categories or (2) fields.

Record
CVE-2014-0010
CVSS 2.0
6.8 MediumAV:N/AC:M/Au:N/C:P/I:P/A:P
Weakness
CWE-352
Updated
2026-11-02
CVE ListNo score

Multiple cross-site request forgery (CSRF) vulnerabilities in user/profile/index.php in Moodle through 2.2.11, 2.3.x before 2.3.11, 2.4.x before 2.4.8, 2.5.x before 2.5.4, and 2.6.x before 2.6.1 allow remote attackers to hijack the authentication of administrators for requests that delete (1) categories or (2) fields.

Record
CVE-2014-0010
Updated
2026-11-02
EUVDEUVD-2014-0114No score

Multiple cross-site request forgery (CSRF) vulnerabilities in user/profile/index.php in Moodle through 2.2.11, 2.3.x before 2.3.11, 2.4.x before 2.4.8, 2.5.x before 2.5.4, and 2.6.x before 2.6.1 allow remote attackers to hijack the authentication of administrators for requests that delete (1) categories or (2) fields.

Record
EUVD-2014-0114
Updated
2026-11-03
GitHub AdvisoriesGHSA-ghqg-3wq5-437qNo score

Multiple cross-site request forgery (CSRF) vulnerabilities in user/profile/index.php in Moodle...

Multiple cross-site request forgery (CSRF) vulnerabilities in user/profile/index.php in Moodle through 2.2.11, 2.3.x before 2.3.11, 2.4.x before 2.4.8, 2.5.x before 2.5.4, and 2.6.x before 2.6.1 allow remote attackers to hijack the authentication of administrators for requests that delete (1) categories or (2) fields.

Record
GHSA-ghqg-3wq5-437q
Weakness
CWE-352
Updated
2026-11-02
OSVMGASA-2014-0053No score

Updated moodle package fixes security vulnerabilities

Updated moodle package fixes security vulnerabilities:

In Moodle before 2.4.8, some password changes on admin pages were being recorded and shown to administrators in the config log report (CVE-2014-0008).

In Moodle before 2.4.8, users were able to log in as a user who in a is not in the same group without the permission to see all groups (CVE-2014-0009).

In Moodle 2.4.8, custom profile fields and categories were open to deletion without proper session checking, due to two Cross-site Request Forgery(CSRF) vulnerabilities in /user/profile/index.php (CVE-2014-0010).

Record
MGASA-2014-0053
Updated
2026-11-02

History

History
RecordedChangedSources
affected, facts
aliasesEUVD
first indexedCVE List, GitHub Advisories, NVD, OSV

Dates are when Every CVE recorded each change. Upstream dates may differ.

References

Show 9 moreShow less
PagesAll vulnerabilitiesBrowseDocsSourcesGuideGet API key
MoveEnter Open