Moodle 1.8.x and 1.9.x before 1.9.8 does not enable the "Regenerate session id during login" setting by default, which makes it easier for remote attackers to conduct session fixation attacks.
CVSS Details
- CVSS 3.1 Base Score: 7.3
Covered by Rapid7
| Product | Vendor Advisory | Solution File | Added | Published |
|---|---|---|---|---|
| Moodle | — | Upgrade to the latest version of Moodle | Nov 7, 2019 | Apr 29, 2010 |
| Suse | — | Upgrade moodle-nnUpgrade moodle-faUpgrade moodle-caUpgrade moodle-tlUpgrade moodle-de_duUpgrade moodle-gaUpgrade moodle-esUpgrade moodle-idUpgrade moodle-beUpgrade moodle-bgUpgrade moodle-ptUpgrade moodle-trUpgrade moodle-heUpgrade moodle-skUpgrade moodle-svUpgrade moodle-lvUpgrade moodle-kaUpgrade moodle-soUpgrade moodle-thUpgrade moodle-isUpgrade moodle-ltUpgrade moodle-elUpgrade moodle-euUpgrade moodle-arUpgrade moodle-glUpgrade moodle-srUpgrade moodle-sqUpgrade moodle-huUpgrade moodle-msUpgrade moodle-daUpgrade moodle-afUpgrade moodle-hiUpgrade moodle-koUpgrade moodle-jaUpgrade moodle-frUpgrade moodle-noUpgrade moodle-nlUpgrade moodle-bsUpgrade moodle-hrUpgrade moodle-csUpgrade moodle-plUpgrade moodle-knUpgrade moodle-ruUpgrade moodleUpgrade moodle-deUpgrade moodle-slUpgrade moodle-fiUpgrade moodle-etUpgrade moodle-itUpgrade moodle-zh_cnUpgrade moodle-kmUpgrade moodle-ukUpgrade moodle-mi_tnUpgrade moodle-roUpgrade moodle-vi | Feb 17, 2015 | Apr 29, 2010 |
Prioritise with Active Threat Intelligence
With curated Threat Intelligence, you can see which vulnerabilities truly put you at risk, prioritize what matters most, and act before attackers do.
Explore Intelligence Hub