PT-2012-1917 · Moodle · Moodle

Darragh Enright

·

CVE-2011-4585

·

Published

2012-07-20

·

Updated

2023-02-13

CVSS v2.0

5.0

Medium

VectorAV:N/AC:L/Au:N/C:P/I:N/A:N
Name of the Vulnerable Software and Affected Versions Moodle versions 1.9.x through 1.9.14
Description The issue concerns the change-password form in the login/change password.php file. It does not utilize https for encryption, even when the httpslogin option is enabled. This oversight allows remote attackers to intercept credentials by sniffing the network.
Recommendations For Moodle versions 1.9.x through 1.9.14, update to version 1.9.15 or later to resolve the issue.

Fix

Found an issue in the description? Have something to add? Feel free to write us 👾
dbugs@ptsecurity.com

Weakness Enumeration

CWE-16

Related Identifiers

CVE-2011-4585
DSA-2421-1

Affected Products

Moodle