Moodle does not force password changes for autosubscribed users
admin/uploaduser_form.php in Moodle 2.0.x before 2.0.3 does not force password changes for autosubscribed users, which makes it easier for remote attackers to obtain access by leveraging knowledge of the initial password of a new user.
01
describes (1)
Related CVEs.
| ID | severity | exploitable | ||
|---|---|---|---|---|
| CVE-2011-4287US | medium6.8 | — | ||
admin/uploaduser_form.php in Moodle 2.0.x before 2.0.3 does not force password changes for autosubscribed users, which makes it easier for remote attackers to obtain access by leve… | ||||
02
references
External citations — patches, advisories, analysis.
- http://git.moodle.orgPACKAGE
- http://git.moodle.org/gw?p=moodle.git%3Ba=commit%3Bh=22a77963439e00441949440f0517135b3a5418daWEB
- http://git.moodle.org/gw?p=moodle.git;a=commit;h=22a77963439e00441949440f0517135b3a5418daWEB
- http://moodle.org/mod/forum/discuss.php?d=175588WEB
- http://openwall.com/lists/oss-security/2011/11/14/1WEB
- https://nvd.nist.gov/vuln/detail/CVE-2011-4287ADVISORY
scry
Advisories like this name the exposed products attackers go after on your perimeter. See what is exposed on your perimeter with a free passive scan.
Free scan