Description
The Multi-Authentication feature in the Central Authentication Service (CAS) functionality in auth/cas/cas_form.html in Moodle 2.1.x before 2.1.6 and 2.2.x before 2.2.3 does not use HTTPS, which allows remote attackers to obtain credentials by sniffing the network.
Remediation
References
Related Vulnerabilities
Drupal Core 8.8.x Cross-Site Request Forgery (8.8.0 - 8.8.7)
WordPress Plugin WP Post to PDF Enhanced Cross-Site Scripting (1.0.5)
Oracle Database Server Deserialization of Untrusted Data Vulnerability (CVE-2017-15095)
MySQL CVE-2022-21417 Vulnerability (CVE-2022-21417)
WordPress Plugin Default Facebook Thumbnails Multiple Vulnerabilities (0.4)