GitHub Advisoryadvisory · Packagist

GHSA-j3x5-cwfj-pfcw Moodle does not force password changes for autosubscribed users

MEDIUM Published 2022-05-13 Modified 2025-04-12 Official page ↗
Aliases
CVE-2011-4287
Ecosystem
Packagist
Packages
moodle/moodle
Severity
Moderate
CVSS vector
CVSS:4.0/AV:N/AC:H/AT:P/PR:N/UI:N/VC:H/VI:H/VA:N/SC:N/SI:N/SA:N/E:U
Weaknesses
CWE-263
Reviewed
2025-04-12

Affected packages

• Packagist moodle/moodle: >= 2.0.0, < 2.0.2 → fixed in 2.0.2

Description

admin/uploaduser_form.php in Moodle 2.0.x before 2.0.3 does not force password changes for autosubscribed users, which makes it easier for remote attackers to obtain access by leveraging knowledge of the initial password of a new user.

Related

Alias · CVE (1)

  • CVE-2011-4287 admin/uploaduser_form.php in Moodle 2.0.x before 2.0.3 does not force password changes for autosubscribed users, which makes it easier for… vulnerability

Weakness · CWE (1)

  • CWE-263 Password Aging with Long Expiration weakness

References