CVEvulnerability
CVE-2011-4584
4.0 MEDIUM
Official page ↗
- Status
- Modified
- Published
- 2012-07-20
- Last modified
- 2026-06-16
- Assigner
- [email protected]
- CVSS 2.0 ([email protected])
- 4.0 MEDIUM — AV:N/AC:L/Au:S/C:N/I:P/A:N
- Weaknesses
- CWE-264
Description
The MNET authentication functionality in Moodle 1.9.x before 1.9.15, 2.0.x before 2.0.6, and 2.1.x before 2.1.3 allows remote authenticated users to impersonate other user accounts by using the Login As feature in conjunction with a remote MNET single sign-on capability, as demonstrated by a Mahara site.
Affected configurations
• moodle moodle 1.9.1
• moodle moodle 1.9.2
• moodle moodle 1.9.3
• moodle moodle 1.9.4
• moodle moodle 1.9.5
• moodle moodle 1.9.6
• moodle moodle 1.9.7
• moodle moodle 1.9.8
• moodle moodle 1.9.9
• moodle moodle 1.9.10
• moodle moodle 1.9.11
• moodle moodle 1.9.12
• moodle moodle 1.9.13
• moodle moodle 1.9.14
• moodle moodle 2.0.0
• moodle moodle 2.0.1
• moodle moodle 2.0.2
• moodle moodle 2.0.3
• moodle moodle 2.0.4
• moodle moodle 2.0.5
• moodle moodle 2.1.0
• moodle moodle 2.1.1
• moodle moodle 2.1.2
Related
Weakness · not in database (1)
References
- http://git.moodle.org/gw?p=moodle.git%3Ba=commit%3Bh=10df8657c1c138c0d0ab1d4796c552fcec0c299b git.moodle.org
- http://moodle.org/mod/forum/discuss.php?d=191751 Vendor Advisory
- http://www.debian.org/security/2012/dsa-2421 www.debian.org
- https://bugzilla.redhat.com/show_bug.cgi?id=761248 bugzilla.redhat.com
- http://git.moodle.org/gw?p=moodle.git%3Ba=commit%3Bh=10df8657c1c138c0d0ab1d4796c552fcec0c299b git.moodle.org
- http://moodle.org/mod/forum/discuss.php?d=191751 Vendor Advisory
- http://www.debian.org/security/2012/dsa-2421 www.debian.org
- https://bugzilla.redhat.com/show_bug.cgi?id=761248 bugzilla.redhat.com