Description

login/change_password.php in Moodle 1.9.x before 1.9.15 does not use https for the change-password form even if the httpslogin option is enabled, which allows remote attackers to obtain credentials by sniffing the network.

Remediation

References

CVE-2011-4585

Related Vulnerabilities

Joomla Improper Neutralization of Input During Web Page Generation ('Cross-site Scripting') Vulnerability (CVE-2017-7985)

WordPress Deserialization of Untrusted Data Vulnerability (CVE-2018-19296)

WordPress Plugin Visitor Traffic Real Time Statistics Cross-Site Request Forgery (2.12)

WordPress Plugin wp Dreamwork Gallery 'upload.php' Arbitrary File Upload (2.1)

Moodle Exposure of Sensitive Information to an Unauthorized Actor Vulnerability (CVE-2016-5014)

Severity

Medium

Classification

CVE-2011-4585

Tags

Missing Update Known Vulnerabilities