VYPR
← All advisories
Moderate severityNVD Advisory· Published May 27, 2014· Updated May 6, 2026

CVE-2014-0214

CVE-2014-0214

Description

login/token.php in Moodle through 2.3.11, 2.4.x before 2.4.10, 2.5.x before 2.5.6, and 2.6.x before 2.6.3 creates a MoodleMobile web-service token with an infinite lifetime, which makes it easier for remote attackers to hijack sessions via a brute-force attack.

Affected packages

Versions sourced from the GitHub Security Advisory.

PackageAffected versionsPatched versions
moodle/moodlePackagist
< 2.4.102.4.10
moodle/moodlePackagist
>= 2.5.0, < 2.5.62.5.6
moodle/moodlePackagist
>= 2.6.0, < 2.6.32.6.3

Patches

4
b5b2eab6778b

MDL-43119 Add valid until dates for tokens created by login/token.php

https://github.com/moodle/moodleJuan LeyvaMay 7, 2014via ghsa
commit
1 file changed · +2 −0
  • login/token.php+2 −0 modified
    @@ -160,6 +160,8 @@
             $token->creatorid = $user->id;
             $token->timecreated = time();
             $token->externalserviceid = $service_record->id;
+            // MDL-43119 Token valid for 3 months (12 weeks).
+            $token->validuntil = $token->timecreated + 12 * WEEKSECS;
             $tokenid = $DB->insert_record('external_tokens', $token);
             add_to_log(SITEID, 'webservice', 'automatically create user token', '' , 'User ID: ' . $user->id);
             $token->id = $tokenid;
679e323aaab2

MDL-43119 Add valid until dates for tokens created by login/token.php

https://github.com/moodle/moodleJuan LeyvaMay 7, 2014via ghsa
commit
1 file changed · +2 −0
  • login/token.php+2 −0 modified
    @@ -160,6 +160,8 @@
             $token->creatorid = $user->id;
             $token->timecreated = time();
             $token->externalserviceid = $service_record->id;
+            // MDL-43119 Token valid for 3 months (12 weeks).
+            $token->validuntil = $token->timecreated + 12 * WEEKSECS;
             $token->id = $DB->insert_record('external_tokens', $token);
 
             $params = array(
14c16a416373

MDL-43119 Add valid until dates for tokens created by login/token.php

https://github.com/moodle/moodleJuan LeyvaMay 7, 2014via ghsa
commit
1 file changed · +2 −0
  • login/token.php+2 −0 modified
    @@ -160,6 +160,8 @@
             $token->creatorid = $user->id;
             $token->timecreated = time();
             $token->externalserviceid = $service_record->id;
+            // MDL-43119 Token valid for 3 months (12 weeks).
+            $token->validuntil = $token->timecreated + 12 * WEEKSECS;
             $token->id = $DB->insert_record('external_tokens', $token);
 
             $params = array(
437240b5aa77

MDL-43119 Add valid until dates for tokens created by login/token.php

https://github.com/moodle/moodleJuan LeyvaMay 7, 2014via ghsa
commit
1 file changed · +2 −0
  • login/token.php+2 −0 modified
    @@ -160,6 +160,8 @@
             $token->creatorid = $user->id;
             $token->timecreated = time();
             $token->externalserviceid = $service_record->id;
+            // MDL-43119 Token valid for 3 months (12 weeks).
+            $token->validuntil = $token->timecreated + 12 * WEEKSECS;
             $tokenid = $DB->insert_record('external_tokens', $token);
             add_to_log(SITEID, 'webservice', 'automatically create user token', '' , 'User ID: ' . $user->id);
             $token->id = $tokenid;

Vulnerability mechanics

Generated by null/stub on May 9, 2026. Inputs: CWE entries + fix-commit diffs from this CVE's patches. Citations validated against bundle.

References

8

News mentions

0

No linked articles in our index yet.