Configuration in Moodle - CVE-2011-4585
Published: July 20, 2012 / Updated: August 11, 2020
Vulnerability identifier: #VU43835
CSH Severity: Medium
CVSS v4: 6.9 [CVSS:4.0/AV:N/AC:L/AT:N/PR:N/UI:N/VC:L/VI:N/VA:N/SC:N/SI:N/SA:N]
CVE-ID: CVE-2011-4585
CWE-ID: CWE-16
Exploitation vector: Remote access
Exploit availability:
No public exploit available
Vulnerability details
The vulnerability allows a remote non-authenticated attacker to gain access to sensitive information.
login/change_password.php in Moodle 1.9.x before 1.9.15 does not use https for the change-password form even if the httpslogin option is enabled, which allows remote attackers to obtain credentials by sniffing the network.
Affected software
Moodle
Fedora
moodle
Fedora
moodle
How to mitigate CVE-2011-4585
Install update from vendor's website.
moodle - update to 2.1.3-1.el6