CVE-2011-4287

Published: Jul 16, 2012Modified: Apr 29, 2026

6.8

Vector

AV:N/AC:M/Au:N/C:P/I:P/A:P

Exploitability: 8.6 / Impact: 6.4

Source: NVD

Description

admin/uploaduser_form.php in Moodle 2.0.x before 2.0.3 does not force password changes for autosubscribed users, which makes it easier for remote attackers to obtain access by leveraging knowledge of the initial password of a new user.

Affected (3)

Products: Moodle: Moodle

Moodle

1 product

Moodle

Configuration A

3 vulnerable

Vulnerable Software	Affected Versions
Moodle Moodle	Version 2.0.0
Moodle Moodle	Version 2.0.1
Moodle Moodle	Version 2.0.2

Related CWEs

CWE-264

References (6)

http://git.moodle.org/gw?p=moodle.git%3Ba=commit%3Bh=22a77963439e00441949440f0517135b3a5418da

Source: secalert@redhat.com

http://moodle.org/mod/forum/discuss.php?d=175588

Source: secalert@redhat.com

Vendor Advisory

http://openwall.com/lists/oss-security/2011/11/14/1

Source: secalert@redhat.com

http://git.moodle.org/gw?p=moodle.git%3Ba=commit%3Bh=22a77963439e00441949440f0517135b3a5418da

Source: af854a3a-2127-422b-91ae-364da2661108

http://moodle.org/mod/forum/discuss.php?d=175588

Source: af854a3a-2127-422b-91ae-364da2661108

Vendor Advisory

http://openwall.com/lists/oss-security/2011/11/14/1

Source: af854a3a-2127-422b-91ae-364da2661108

Timeline

No history available yet.