Colin Campbell

**Name of the Vulnerable Software and Affected Versions** Moodle versions prior to 2.3.11 Moodle versions 2.4.x prior to 2.4.11 Moodle versions 2.5.x prior to 2.5.7 **Description** The issue concerns the Shibboleth authentication plugin in Moodle, which fails to check if a session ID is empty. This allows remote authenticated users to hijack sessions through crafted plugin interaction. **Recommendations** For versions prior to 2.3.11, update to version 2.3.11 or later. For versions 2.4.x prior to 2.4.11, update to version 2.4.11 or later. For versions 2.5.x prior to 2.5.7, update to version 2.5.7 or later.

**Name of the Vulnerable Software and Affected Versions** Moodle versions 2.0.x through 2.0.4 Moodle versions 2.1.x through 2.1.1 **Description** The issue allows remote attackers to bypass intended access restrictions by leveraging the hubs feature, due to the incorrect setting of the `registration hubs.secret` value during installation. **Recommendations** For Moodle versions 2.0.x through 2.0.4, update to version 2.0.5 or later. For Moodle versions 2.1.x through 2.1.1, update to version 2.1.2 or later.