PT-2012-1917 · Moodle · Moodle

Darragh Enright · Publicado 2012-07-20 · Atualizado 2023-02-13 · CVE-2011-4585

Positive Technologies (AI Summary)

CVSS v2.0

5.0

Média

Vetor base

AV:N/AC:L/Au:N/C:P/I:N/A:N

Name of the Vulnerable Software and Affected Versions Moodle versions 1.9.x through 1.9.14

Description The issue concerns the change-password form in the login/change password.php file. It does not utilize https for encryption, even when the httpslogin option is enabled. This oversight allows remote attackers to intercept credentials by sniffing the network.

Recommendations For Moodle versions 1.9.x through 1.9.14, update to version 1.9.15 or later to resolve the issue.

Correção

Enumeração de Fraquezas

CWE-16

Identificadores relacionados

CVE-2011-4585

DSA-2421-1

Produtos afetados

Moodle

Referências · 6

• http://git.moodle.org/gw?p=moodle.git%3Ba=commit%3Bh=01dd64a8c8aa95f793accea371b2392e662663c5 · Nota
• https://bugzilla.redhat.com/show_bug.cgi?id=761248 · Nota
• http://debian.org/security/2012/dsa-2421 · Aviso do Fabricante
• https://nvd.nist.gov/vuln/detail/CVE-2011-4585 · Nota de Segurança
• http://moodle.org/mod/forum/discuss.php?d=191752 · Aviso do Fabricante
• https://cve.mitre.org/cgi-bin/cvename.cgi?name=CVE-2011-4585 · Nota