PT-2012-1917 · Moodle · Moodle

Darragh Enright · Published 2012-07-20 · Updated 2023-02-13 · CVE-2011-4585

Positive Technologies (AI Summary)

CVSS v2.0

5.0

Medium

Base vector

AV:N/AC:L/Au:N/C:P/I:N/A:N

Name of the Vulnerable Software and Affected Versions Moodle versions 1.9.x through 1.9.14

Description The issue concerns the change-password form in the login/change password.php file. It does not utilize https for encryption, even when the httpslogin option is enabled. This oversight allows remote attackers to intercept credentials by sniffing the network.

Recommendations For Moodle versions 1.9.x through 1.9.14, update to version 1.9.15 or later to resolve the issue.

Fix

Weakness Enumeration

CWE-16

Related Identifiers

CVE-2011-4585

DSA-2421-1

Affected Products

Moodle

References · 6

• http://debian.org/security/2012/dsa-2421 · Vendor Advisory
• https://nvd.nist.gov/vuln/detail/CVE-2011-4585 · Security Note
• http://moodle.org/mod/forum/discuss.php?d=191752 · Vendor Advisory
• http://git.moodle.org/gw?p=moodle.git%3Ba=commit%3Bh=01dd64a8c8aa95f793accea371b2392e662663c5 · Note
• https://bugzilla.redhat.com/show_bug.cgi?id=761248 · Note
• https://cve.mitre.org/cgi-bin/cvename.cgi?name=CVE-2011-4585 · Note