CVE-2011-4585

Published: Jul 20, 2012Modified: Apr 29, 2026

5.0

Vector

AV:N/AC:L/Au:N/C:P/I:N/A:N

Exploitability: 10.0 / Impact: 2.9

Source: NVD

Description

login/change_password.php in Moodle 1.9.x before 1.9.15 does not use https for the change-password form even if the httpslogin option is enabled, which allows remote attackers to obtain credentials by sniffing the network.

Affected (14)

Products: Moodle: Moodle

Moodle

1 product

Moodle

Configuration A

14 vulnerable

Vulnerable Software	Affected Versions
Moodle Moodle	Version 1.9.10
Moodle Moodle	Version 1.9.11
Moodle Moodle	Version 1.9.12
Moodle Moodle	Version 1.9.13
Moodle Moodle	Version 1.9.14
Moodle Moodle	Version 1.9.1
Moodle Moodle	Version 1.9.2
Moodle Moodle	Version 1.9.3
Moodle Moodle	Version 1.9.4
Moodle Moodle	Version 1.9.5
Moodle Moodle	Version 1.9.6
Moodle Moodle	Version 1.9.7
Moodle Moodle	Version 1.9.8
Moodle Moodle	Version 1.9.9