Description
auth/ldap/ntlmsso_attempt.php in Moodle 2.0.x before 2.0.10, 2.1.x before 2.1.7, 2.2.x before 2.2.4, and 2.3.x before 2.3.1 redirects users from an https LDAP login URL to an http URL, which allows remote attackers to obtain sensitive information by sniffing the network.
Remediation
References
Related Vulnerabilities
Liferay DXP Unrestricted Upload of File with Dangerous Type Vulnerability (CVE-2025-43766)
SharePoint CVE-2022-38053 Vulnerability (CVE-2022-38053)
WordPress Plugin Booking Ultra Pro Appointments Booking Calendar Local File Inclusion (1.1.13)
Jenkins Cross-Site Request Forgery (CSRF) Vulnerability (CVE-2020-2160)
Drupal Improper Control of Generation of Code ('Code Injection') Vulnerability (CVE-2013-6385)