PT-2010-3283 · Moodle · Moodle

Published 2010-04-29 · Updated 2022-05-13 · CVE-2010-1613

Positive Technologies (AI Summary)

CVSS v2.0

6.8

Medium

Base vector

AV:N/AC:M/Au:N/C:P/I:P/A:P

Name of the Vulnerable Software and Affected Versions Moodle versions 1.8.x through 1.9.7

Description The issue makes it easier for remote attackers to conduct session fixation attacks because a specific security setting is not enabled by default.

Recommendations For Moodle versions 1.8.x through 1.9.7, enable the "Regenerate session id during login" setting to mitigate the risk of session fixation attacks.

Fix

Session Fixation

Improper Authentication

Weakness Enumeration

CWE-384

CWE-287

Related Identifiers

CVE-2010-1613

DSA-2115-1

GHSA-J5RC-CR5W-VFG6

Affected Products

Moodle

References · 6

• https://osv.dev/vulnerability/GHSA-j5rc-cr5w-vfg6 · Vendor Advisory
• https://nvd.nist.gov/vuln/detail/CVE-2010-1613 · Security Note
• http://lists.opensuse.org/opensuse-security-announce/2010-05/msg00001.html · Vendor Advisory
• https://github.com/moodle/moodle · Note
• http://moodle.org/security · Note
• http://vupen.com/english/advisories/2010/1107 · Note