CVEvulnerability
CVE-2011-4587
6.8 MEDIUM
Official page ↗
- Status
- Modified
- Published
- 2012-07-20
- Last modified
- 2026-06-16
- Assigner
- [email protected]
- CVSS 2.0 ([email protected])
- 6.8 MEDIUM — AV:N/AC:M/Au:N/C:P/I:P/A:P
- Weaknesses
- CWE-255
Description
lib/moodlelib.php in Moodle 1.9.x before 1.9.15, 2.0.x before 2.0.6, and 2.1.x before 2.1.3 does not properly handle certain zero values in the password policy, which makes it easier for remote attackers to obtain access by leveraging the possible existence of user accounts that have unchangeable blank passwords.
Affected configurations
• moodle moodle 1.9.1
• moodle moodle 1.9.2
• moodle moodle 1.9.3
• moodle moodle 1.9.4
• moodle moodle 1.9.5
• moodle moodle 1.9.6
• moodle moodle 1.9.7
• moodle moodle 1.9.8
• moodle moodle 1.9.9
• moodle moodle 1.9.10
• moodle moodle 1.9.11
• moodle moodle 1.9.12
• moodle moodle 1.9.13
• moodle moodle 1.9.14
• moodle moodle 2.0.0
• moodle moodle 2.0.1
• moodle moodle 2.0.2
• moodle moodle 2.0.3
• moodle moodle 2.0.4
• moodle moodle 2.0.5
• moodle moodle 2.1.0
• moodle moodle 2.1.1
• moodle moodle 2.1.2
Related
Weakness · not in database (1)
References
- http://git.moodle.org/gw?p=moodle.git%3Ba=commit%3Bh=e079e82c087becf06d902089d14f3f76686bde19 git.moodle.org
- http://moodle.org/mod/forum/discuss.php?d=191755 Vendor Advisory
- http://www.debian.org/security/2012/dsa-2421 www.debian.org
- https://bugzilla.redhat.com/show_bug.cgi?id=761248 bugzilla.redhat.com
- http://git.moodle.org/gw?p=moodle.git%3Ba=commit%3Bh=e079e82c087becf06d902089d14f3f76686bde19 git.moodle.org
- http://moodle.org/mod/forum/discuss.php?d=191755 Vendor Advisory
- http://www.debian.org/security/2012/dsa-2421 www.debian.org
- https://bugzilla.redhat.com/show_bug.cgi?id=761248 bugzilla.redhat.com