Mike Churchward

**Name of the Vulnerable Software and Affected Versions** Moodle versions 1.8 through 1.8.10 Moodle versions 1.9 through 1.9.6 **Description** The issue allows remote attackers to obtain login credentials by sniffing, as the login form links to an index page on the HTTP port even when the page is served from an HTTPS port, potentially causing login credentials to be sent in cleartext. **Recommendations** For Moodle versions 1.8 through 1.8.10, update to version 1.8.11 or later. For Moodle versions 1.9 through 1.9.6, update to version 1.9.7 or later.