Description
The Shibboleth authentication plugin in auth/shibboleth/index.php in Moodle through 2.3.11, 2.4.x before 2.4.11, and 2.5.x before 2.5.7 does not check whether a session ID is empty, which allows remote authenticated users to hijack sessions via crafted plugin interaction.
Remediation
References
Related Vulnerabilities
MongoDb Improper Input Validation Vulnerability (CVE-2021-20330)
PHP Other Vulnerability (CVE-2007-5424)
ownCloud Permissions, Privileges, and Access Controls Vulnerability (CVE-2013-2048)
WordPress Plugin Easy Forms for MailChimp Cross-Site Scripting (6.1.2)
WordPress 4.8.x Denial of Service Vulnerability (4.8 - 4.8.5)