Moodle allows attackers to bypass intended login restrictions
login/confirm.php in Moodle through 2.5.9, 2.6.x before 2.6.11, 2.7.x before 2.7.8, and 2.8.x before 2.8.6 allows remote authenticated users to bypass intended login restrictions by leveraging access to an unconfirmed suspended account.
01
describes (1)
Related CVEs.
| ID | severity | exploitable | ||
|---|---|---|---|---|
| CVE-2015-3179US | low3.5 | — | ||
login/confirm.php in Moodle through 2.5.9, 2.6.x before 2.6.11, 2.7.x before 2.7.8, and 2.8.x before 2.8.6 allows remote authenticated users to bypass intended login restrictions b… | ||||
02
references
External citations — patches, advisories, analysis.
- http://git.moodle.org/gw?p=moodle.git&a=search&h=HEAD&st=commit&s=MDL-50090WEB
- http://openwall.com/lists/oss-security/2015/05/18/1WEB
- https://github.com/moodle/moodlePACKAGE
- https://github.com/moodle/moodle/commit/78ec6751fc57bb17bb67c26870fea396390b9937WEB
- https://github.com/moodle/moodle/commit/811ae9f082697495248c6c87ec80aeaf88c851fcWEB
- https://github.com/moodle/moodle/commit/98c38993fd6cbd78bf5819c68c55fcfded6467c0WEB
- https://github.com/moodle/moodle/commit/f236dcc35c3595dfcc77932d84660056e982a310WEB
- https://moodle.org/mod/forum/discuss.php?d=313686WEB
scry
Advisories like this name the exposed products attackers go after on your perimeter. See what is exposed on your perimeter with a free passive scan.
Free scan