CVE-2011-4585 : login/change_password.php in Moodle 1.9.x before 1.9.15 does not use https for the change-password form even if the http

login/change_password.php in Moodle 1.9.x before 1.9.15 does not use https for the change-password form even if the httpslogin option is enabled, which allows remote attackers to obtain credentials by sniffing the network.

Published 2012-07-20 10:40:36

Updated 2023-02-13 00:21:27

Source Red Hat, Inc.

View at NVD, CVE.org

Products affected by CVE-2011-4585

Moodle » Moodle » Version: 1.9.1
cpe:2.3:a:moodle:moodle:1.9.1:*:*:*:*:*:*:*
Matching versions
Moodle » Moodle » Version: 1.9.2
cpe:2.3:a:moodle:moodle:1.9.2:*:*:*:*:*:*:*
Matching versions
Moodle » Moodle » Version: 1.9.3
cpe:2.3:a:moodle:moodle:1.9.3:*:*:*:*:*:*:*
Matching versions
Moodle » Moodle » Version: 1.9.4
cpe:2.3:a:moodle:moodle:1.9.4:*:*:*:*:*:*:*
Matching versions
Moodle » Moodle » Version: 1.9.5
cpe:2.3:a:moodle:moodle:1.9.5:*:*:*:*:*:*:*
Matching versions
Moodle » Moodle » Version: 1.9.6
cpe:2.3:a:moodle:moodle:1.9.6:*:*:*:*:*:*:*
Matching versions
Moodle » Moodle » Version: 1.9.7
cpe:2.3:a:moodle:moodle:1.9.7:*:*:*:*:*:*:*
Matching versions
Moodle » Moodle » Version: 1.9.8
cpe:2.3:a:moodle:moodle:1.9.8:*:*:*:*:*:*:*
Matching versions
Moodle » Moodle » Version: 1.9.10
cpe:2.3:a:moodle:moodle:1.9.10:*:*:*:*:*:*:*
Matching versions
Moodle » Moodle » Version: 1.9.9
cpe:2.3:a:moodle:moodle:1.9.9:*:*:*:*:*:*:*
Matching versions
Moodle » Moodle » Version: 1.9.12
cpe:2.3:a:moodle:moodle:1.9.12:*:*:*:*:*:*:*
Matching versions
Moodle » Moodle » Version: 1.9.13
cpe:2.3:a:moodle:moodle:1.9.13:*:*:*:*:*:*:*
Matching versions
Moodle » Moodle » Version: 1.9.11
cpe:2.3:a:moodle:moodle:1.9.11:*:*:*:*:*:*:*
Matching versions
Moodle » Moodle » Version: 1.9.14
cpe:2.3:a:moodle:moodle:1.9.14:*:*:*:*:*:*:*
Matching versions

Exploit prediction scoring system (EPSS) score for CVE-2011-4585

EPSS FAQ

0.36%

Probability of exploitation activity in the next 30 days EPSS Score History

~ 68 %

Percentile, the proportion of vulnerabilities that are scored at or less

CVSS scores for CVE-2011-4585

Base Score	Base Severity	CVSS Vector	Exploitability Score	Impact Score	Score Source	First Seen
5.0	MEDIUM	AV:N/AC:L/Au:N/C:P/I:N/A:N	10.0	2.9	NIST
Access Vector: Network Access Complexity: Low Authentication: None Confidentiality Impact: Partial Integrity Impact: None Availability Impact: None

CWE ids for CVE-2011-4585

CWE-16

Assigned by: nvd@nist.gov (Primary)

References for CVE-2011-4585

https://bugzilla.redhat.com/show_bug.cgi?id=761248

761248 – (CVE-2011-4581, CVE-2011-4582, CVE-2011-4583, CVE-2011-4584, CVE-2011-4585, CVE-2011-4586, CVE-2011-4587, CVE-2011-4588, CVE-2011-4589, CVE-2011-4590, CVE-2011-4591, CVE-2011-4592, CVE-2011-4

CVEs referencing this url
http://www.debian.org/security/2012/dsa-2421

Debian -- Security Information -- DSA-2421-1 moodle

CVEs referencing this url
http://git.moodle.org/gw?p=moodle.git%3Ba=commit%3Bh=01dd64a8c8aa95f793accea371b2392e662663c5

Official Moodle git projects
http://moodle.org/mod/forum/discuss.php?d=191752

Moodle.org: MSA-11-0046: Insecure authentication transmission
Vendor Advisory

Jump to

Vulnerability Details : CVE-2011-4585

Products affected by CVE-2011-4585

Exploit prediction scoring system (EPSS) score for CVE-2011-4585

CVSS scores for CVE-2011-4585

CWE ids for CVE-2011-4585

References for CVE-2011-4585