login/index_form.html in Moodle 1.8 before 1.8.11 and 1.9 before 1.9.7 links to an index page on the HTTP port even when the page is served from an HTTPS port, which might cause login credentials to be sent in cleartext, even when SSL is intended, and allows remote attackers to obtain these credentials by sniffing.
CVSS Details
- CVSS 3.1 Base Score: 5.3
Covered by Rapid7
| Product | Vendor Advisory | Solution File | Added | Published |
|---|---|---|---|---|
| Moodle | — | Upgrade to the latest version of Moodle | Dec 4, 2018 | Dec 16, 2009 |
| Suse | — | Upgrade moodle-esUpgrade moodle-arUpgrade moodle-kmUpgrade moodle-slUpgrade moodle-bgUpgrade moodle-ruUpgrade moodle-hrUpgrade moodle-tlUpgrade moodle-msUpgrade moodle-daUpgrade moodleUpgrade moodle-mi_tnUpgrade moodle-skUpgrade moodle-jaUpgrade moodle-elUpgrade moodle-svUpgrade moodle-noUpgrade moodle-nnUpgrade moodle-knUpgrade moodle-huUpgrade moodle-srUpgrade moodle-caUpgrade moodle-deUpgrade moodle-gaUpgrade moodle-faUpgrade moodle-soUpgrade moodle-hiUpgrade moodle-isUpgrade moodle-idUpgrade moodle-glUpgrade moodle-roUpgrade moodle-plUpgrade moodle-fiUpgrade moodle-afUpgrade moodle-trUpgrade moodle-lvUpgrade moodle-nlUpgrade moodle-ptUpgrade moodle-heUpgrade moodle-bsUpgrade moodle-viUpgrade moodle-etUpgrade moodle-frUpgrade moodle-kaUpgrade moodle-de_duUpgrade moodle-zh_cnUpgrade moodle-euUpgrade moodle-sqUpgrade moodle-koUpgrade moodle-csUpgrade moodle-beUpgrade moodle-itUpgrade moodle-thUpgrade moodle-ltUpgrade moodle-uk | Feb 17, 2015 | Dec 15, 2009 |
Prioritise with Active Threat Intelligence
With curated Threat Intelligence, you can see which vulnerabilities truly put you at risk, prioritize what matters most, and act before attackers do.
Explore Intelligence Hub