login/index_form.html in Moodle 1.8 before 1.8.11 and 1.9 before 1.9.7 links to an index page on the HTTP port even when the page is served from an HTTPS port, which might cause login credentials to be sent in cleartext, even when SSL is intended, and allows remote attackers to obtain these credentials by sniffing.
CVSS Details
- CVSS 3.1 Base Score: 5.3
Covered by Rapid7
| Product | Vendor Advisory | Solution File | Added | Published |
|---|---|---|---|---|
| Moodle | — | Upgrade to the latest version of Moodle | Dec 4, 2018 | Dec 16, 2009 |
| Suse | — | Upgrade moodle-faUpgrade moodle-srUpgrade moodle-elUpgrade moodle-skUpgrade moodle-deUpgrade moodle-svUpgrade moodle-isUpgrade moodle-tlUpgrade moodle-bgUpgrade moodle-daUpgrade moodleUpgrade moodle-caUpgrade moodle-idUpgrade moodle-glUpgrade moodle-ruUpgrade moodle-hiUpgrade moodle-soUpgrade moodle-jaUpgrade moodle-huUpgrade moodle-arUpgrade moodle-esUpgrade moodle-kmUpgrade moodle-knUpgrade moodle-hrUpgrade moodle-nnUpgrade moodle-noUpgrade moodle-gaUpgrade moodle-slUpgrade moodle-msUpgrade moodle-mi_tnUpgrade moodle-nlUpgrade moodle-roUpgrade moodle-de_duUpgrade moodle-plUpgrade moodle-ptUpgrade moodle-etUpgrade moodle-ukUpgrade moodle-afUpgrade moodle-trUpgrade moodle-lvUpgrade moodle-thUpgrade moodle-beUpgrade moodle-ltUpgrade moodle-csUpgrade moodle-zh_cnUpgrade moodle-sqUpgrade moodle-frUpgrade moodle-kaUpgrade moodle-itUpgrade moodle-bsUpgrade moodle-heUpgrade moodle-fiUpgrade moodle-euUpgrade moodle-koUpgrade moodle-vi | Feb 17, 2015 | Dec 15, 2009 |
Prioritise with Active Threat Intelligence
With curated Threat Intelligence, you can see which vulnerabilities truly put you at risk, prioritize what matters most, and act before attackers do.
Explore Intelligence Hub