CVSS2
Attack Vector
NETWORK
Attack Complexity
LOW
Authentication
NONE
Confidentiality Impact
PARTIAL
Integrity Impact
NONE
Availability Impact
NONE
AV:N/AC:L/Au:N/C:P/I:N/A:N
AI Score
Confidence
Low
EPSS
Percentile
72.2%
login/change_password.php in Moodle 1.9.x before 1.9.15 does not use https for the change-password form even if the httpslogin option is enabled, which allows remote attackers to obtain credentials by sniffing the network.
Vendor | Product | Version | CPE |
---|---|---|---|
moodle | moodle | 1.9.1 | cpe:/a:moodle:moodle:1.9.1::: |
moodle | moodle | 1.9.7 | cpe:/a:moodle:moodle:1.9.7::: |
moodle | moodle | 1.9.6 | cpe:/a:moodle:moodle:1.9.6::: |
moodle | moodle | 1.9.11 | cpe:/a:moodle:moodle:1.9.11::: |
moodle | moodle | 1.9.10 | cpe:/a:moodle:moodle:1.9.10::: |
moodle | moodle | 1.9.14 | cpe:/a:moodle:moodle:1.9.14::: |
moodle | moodle | 1.9.2 | cpe:/a:moodle:moodle:1.9.2::: |
moodle | moodle | 1.9.5 | cpe:/a:moodle:moodle:1.9.5::: |
moodle | moodle | 1.9.9 | cpe:/a:moodle:moodle:1.9.9::: |
moodle | moodle | 1.9.13 | cpe:/a:moodle:moodle:1.9.13::: |
More