{"id":"CVE-2014-0010","aliases":["EUVD-2014-0114","GHSA-ghqg-3wq5-437q","MGASA-2014-0053"],"status":"published","title":"Multiple cross-site request forgery (CSRF) vulnerabilities in user/profile/index.php in Moodle...","description":"Multiple cross-site request forgery (CSRF) vulnerabilities in user/profile/index.php in Moodle through 2.2.11, 2.3.x before 2.3.11, 2.4.x before 2.4.8, 2.5.x before 2.5.4, and 2.6.x before 2.6.1 allow remote attackers to hijack the authentication of administrators for requests that delete (1) categories or (2) fields.","severity":{"version":"2.0","score":6.8,"vector":"AV:N/AC:M/Au:N/C:P/I:P/A:P","level":"medium","assessor":"primary","from":"nvd"},"epss":{"day":"2026-11-08","score":0.01095,"percentile":0.65753,"model":"v2026.06.15"},"facts":{"in_kev":false,"known_exploited":false,"public_exploit":false,"fix_available":false},"cwes":["CWE-352"],"published":"2014-01-20T11:00:00Z","modified":"2026-06-17T00:02:04Z","affected":[{"source":"osv","ecosystem":"Mageia:3","package":"moodle","ranges":[{"type":"ECOSYSTEM","events":[{"introduced":"0"},{"fixed":"2.4.8-1.mga3"}]}],"bundled":3},{"source":"osv","ecosystem":"Mageia:4","package":"moodle","ranges":[{"type":"ECOSYSTEM","events":[{"introduced":"0"},{"fixed":"2.4.8-1.mga4"}]}],"bundled":3}],"products":[{"vendor":"fedoraproject","product":"fedora"},{"vendor":"moodle","product":"moodle"}],"references":[{"url":"http://openwall.com/lists/oss-security/2014/01/20/1","tags":["mailing-list","x_refsource_MLIST","x_transferred"]},{"url":"https://moodle.org/mod/forum/discuss.php?d=252416","tags":["x_refsource_CONFIRM","x_transferred","Patch","Vendor Advisory","web"]},{"url":"http://osvdb.org/102261","tags":["vdb-entry","x_refsource_OSVDB","x_transferred"]},{"url":"http://lists.fedoraproject.org/pipermail/package-announce/2014-January/127533.html","tags":["vendor-advisory","x_refsource_FEDORA","x_transferred"]},{"url":"http://git.moodle.org/gw?p=moodle.git\u0026a=search\u0026h=HEAD\u0026st=commit\u0026s=MDL-42883","tags":["x_refsource_CONFIRM","x_transferred","Patch"]},{"url":"http://www.securitytracker.com/id/1029649","tags":["vdb-entry","x_refsource_SECTRACK","x_transferred"]},{"url":"http://lists.fedoraproject.org/pipermail/package-announce/2014-January/127510.html","tags":["vendor-advisory","x_refsource_FEDORA","x_transferred"]},{"url":"https://nvd.nist.gov/vuln/detail/CVE-2014-0010"},{"url":"https://github.com/advisories/GHSA-ghqg-3wq5-437q"},{"url":"https://advisories.mageia.org/MGASA-2014-0053.html","tags":["advisory"]},{"url":"https://bugs.mageia.org/show_bug.cgi?id=12385","tags":["report"]},{"url":"https://moodle.org/mod/forum/discuss.php?d=252414","tags":["web"]},{"url":"https://moodle.org/mod/forum/discuss.php?d=252415","tags":["web"]},{"url":"http://docs.moodle.org/dev/Moodle_2.4.8_release_notes","tags":["web"]},{"url":"https://moodle.org/mod/forum/discuss.php?d=251856","tags":["web"]},{"url":"https://lists.fedoraproject.org/pipermail/package-announce/2014-January/127510.html","tags":["web"]}],"sources":{"cve":[{"id":"CVE-2014-0010","description":"Multiple cross-site request forgery (CSRF) vulnerabilities in user/profile/index.php in Moodle through 2.2.11, 2.3.x before 2.3.11, 2.4.x before 2.4.8, 2.5.x before 2.5.4, and 2.6.x before 2.6.1 allow remote attackers to hijack the authentication of administrators for requests that delete (1) categories or (2) fields.","status":"published","published":"2014-01-20T11:00:00Z","modified":"2024-08-06T08:58:26.557Z","updated_at":"2026-11-02T14:33:47.330011Z"}],"euvd":[{"id":"EUVD-2014-0114","description":"Multiple cross-site request forgery (CSRF) vulnerabilities in user/profile/index.php in Moodle through 2.2.11, 2.3.x before 2.3.11, 2.4.x before 2.4.8, 2.5.x before 2.5.4, and 2.6.x before 2.6.1 allow remote attackers to hijack the authentication of administrators for requests that delete (1) categories or (2) fields.","status":"published","published":"2014-01-20T11:00:00Z","modified":"2024-08-06T08:58:26Z","updated_at":"2026-11-03T01:57:23.42372Z"}],"ghsa":[{"id":"GHSA-ghqg-3wq5-437q","title":"Multiple cross-site request forgery (CSRF) vulnerabilities in user/profile/index.php in Moodle...","description":"Multiple cross-site request forgery (CSRF) vulnerabilities in user/profile/index.php in Moodle through 2.2.11, 2.3.x before 2.3.11, 2.4.x before 2.4.8, 2.5.x before 2.5.4, and 2.6.x before 2.6.1 allow remote attackers to hijack the authentication of administrators for requests that delete (1) categories or (2) fields.","status":"published","published":"2022-05-13T01:12:49Z","modified":"2023-02-01T05:03:53Z","cwes":["CWE-352"],"updated_at":"2026-11-02T14:50:06.799159Z"}],"nvd":[{"id":"CVE-2014-0010","description":"Multiple cross-site request forgery (CSRF) vulnerabilities in user/profile/index.php in Moodle through 2.2.11, 2.3.x before 2.3.11, 2.4.x before 2.4.8, 2.5.x before 2.5.4, and 2.6.x before 2.6.1 allow remote attackers to hijack the authentication of administrators for requests that delete (1) categories or (2) fields.","status":"published","published":"2014-01-20T15:14:32.347Z","modified":"2026-06-17T00:02:04.963Z","cvss":[{"version":"2.0","score":6.8,"vector":"AV:N/AC:M/Au:N/C:P/I:P/A:P","level":"medium","assessor":"primary"}],"cwes":["CWE-352"],"updated_at":"2026-11-02T14:02:53.330367Z"}],"osv":[{"id":"MGASA-2014-0053","title":"Updated moodle package fixes security vulnerabilities","description":"Updated moodle package fixes security vulnerabilities:\n\nIn Moodle before 2.4.8, some password changes on admin pages were being\nrecorded and shown to administrators in the config log report\n(CVE-2014-0008).\n\nIn Moodle before 2.4.8, users were able to log in as a user who in a is\nnot in the same group without the permission to see all groups\n(CVE-2014-0009).\n\nIn Moodle 2.4.8, custom profile fields and categories were open to\ndeletion without proper session checking, due to two Cross-site Request\nForgery(CSRF) vulnerabilities in /user/profile/index.php (CVE-2014-0010).\n","status":"published","published":"2014-02-11T22:34:37Z","modified":"2026-04-16T06:24:16.155352419Z","updated_at":"2026-11-02T15:49:39.121227Z"}]}}