GitHub Advisoryadvisory · Packagist

GHSA-j5rc-cr5w-vfg6 Moodle Session Fixation vulnerability

MEDIUM Published 2022-05-13 Modified 2025-04-11 Official page ↗
Aliases
CVE-2010-1613
Ecosystem
Packagist
Packages
moodle/moodle
Severity
Moderate
CVSS vector
CVSS:4.0/AV:N/AC:L/AT:N/PR:N/UI:N/VC:N/VI:H/VA:N/SC:N/SI:N/SA:N/E:U
Weaknesses
CWE-287, CWE-384
Reviewed
2025-04-11

Affected packages

• Packagist moodle/moodle: >= 1.8.0, < 1.9.8 → fixed in 1.9.8

Description

Moodle 1.8.x and 1.9.x before 1.9.8 does not enable the "Regenerate session id during login" setting by default, which makes it easier for remote attackers to conduct session fixation attacks.

Related

Alias · CVE (1)

  • CVE-2010-1613 Moodle 1.8.x and 1.9.x before 1.9.8 does not enable the "Regenerate session id during login" setting by default, which makes it easier for… vulnerability

Weakness · CWE (2)

  • CWE-287 Improper Authentication weakness
  • CWE-384 Session Fixation weakness

References