CVE-2007-1647

HighCVSS 7.8/10Last modified Jun 16, 2026

Description

Moodle 1.5.2 and earlier stores sensitive information under the web root with insufficient access control, and provides directory listings, which allows remote attackers to obtain user names, password hashes, and other sensitive information via a direct request for session (sess_*) files in moodledata/sessions/.

Metrics

CVSS 2.0 7.8/10AV:N/AC:L/Au:N/C:C/I:N/A:N

Affected software

No affected versions have been published.

Timeline

Published: Mar 24, 2007
Last modified: Jun 16, 2026
NVD status: Modified

Related CVEs from 2007

CVE-2007-16487.80irc 1345 build 20060823 allows remote attackers to cause a denial of service (application crash) by operating an IRC server that sends a lo CVE-2007-16497.8PHP 5.2.1 allows context-dependent attackers to read portions of heap memory by executing certain scripts with a serialized data input strin CVE-2007-16507.8pcapsipdump.cpp in pcapsipdump before 0.1.3 allows remote attackers to cause a denial of service (application crash) via a malformed SIP pac CVE-2007-16516.8Cross-site request forgery (CSRF) vulnerability in OpenID allows remote attackers to restore the login session of a user on an OpenID enable CVE-2007-16527.5OpenID allows remote attackers to forcibly log a user into an OpenID enabled site, divulge the user's personal information to this site, and CVE-2007-16537.8GlowWorm FW before 1.5.3b4 allows remote attackers to cause a denial of service (kernel panic) via certain DNS responses that trigger infini CVE-2007-16549.3Buffer overflow in the Ne7sshSftp::addOpenHandle function in ne7ssh_sftp.cpp in NetSieben SSH Library (ne7ssh) before 1.2.1 allows user-assi CVE-2007-165510.0Buffer overflow in the fun_ladd function in funmath.cpp in TinyMUX before 20070126 might allow remote attackers to cause a denial of service CVE-2007-16567.5Multiple SQL injection vulnerabilities in index.php in Katalog Plyt Audio 1.0 and earlier allow remote attackers to execute arbitrary SQL co CVE-2007-16577.5Stack-based buffer overflow in the file_compress function in minigzip (Modules/zlib) in Python 2.5 allows context-dependent attackers to exe CVE-2007-16589.3Windows Mail in Microsoft Windows Vista might allow user-assisted remote attackers to execute certain programs via a link to a (1) local fil CVE-2007-16596.8Perl-Compatible Regular Expression (PCRE) library before 7.3 allows context-dependent attackers to cause a denial of service (crash) and pos