CVE-2007-1647 describes a critical information disclosure vulnerability in Moodle versions 1.5.2 and earlier. The flaw allows remote attackers to directly access session files (sess_*) stored under the web root in moodledata/sessions/ due to insufficient access control and enabled directory listings. This exposure can lead to the compromise of sensitive data, including usernames and password hashes. With a CVSS score of 7.8 (High), this vulnerability is easily exploitable over the network without authentication (AV:N/AC:L/Au:N), resulting in a complete compromise of confidentiality (C:C). The FAUCET Risk Score of 91/100 further highlights its severity. While not listed in CISA's KEV catalog, an exploit (EDB-3508) is publicly available on ExploitDB, indicating the existence of proof-of-concept code. Despite this, there is no evidence of active exploitation, significant community discussion, or media coverage surrounding this specific CVE.
| Vendor | Product | Version(s) | CPE |
|---|---|---|---|
<= 1.5.2CPE matchmatch criteria | cpe:2.3:a:moodle:moodle:*:*:*:*:*:*:*:* |
CVSS version used by this source: 2.0
AV:N/AC:L/Au:N/C:C/I:N/A:N
No social media mentions found for this CVE.
The average CVE in this peer group has 0.0 Twitter, 0.0 Reddit, 0.1 Bluesky, 0.1 Mastodon, and 0.4 GitHub mentions.
No media coverage found for this CVE.
The average CVE in this peer group has 0.1 InfoSec Media, 0.0 Vendor Blog, and 0.0 Security Researcher mentions.
Remediation records are not available for this CVE.