Lucene search
RedhatCVE-2012-2357HistoryJul 21, 2012 - 3:38 a.m.
CVE-2012-2357
2012-07-2103:38:55
CWE-200
redhat
web.nvd.nist.gov
28
cve-2012-2357
multi-authentication
cas
central authentication service
moodle
https
credentials sniffing
network security
CVSS2
5
Attack Vector
NETWORK
Attack Complexity
LOW
Authentication
NONE
Confidentiality Impact
PARTIAL
Integrity Impact
NONE
Availability Impact
NONE
AV:N/AC:L/Au:N/C:P/I:N/A:N
AI Score
6.4
Confidence
Low
EPSS
0.002
Percentile
55.9%
The Multi-Authentication feature in the Central Authentication Service (CAS) functionality in auth/cas/cas_form.html in Moodle 2.1.x before 2.1.6 and 2.2.x before 2.2.3 does not use HTTPS, which allows remote attackers to obtain credentials by sniffing the network.
Affected configurations
Node
moodlemoodleMatch2.1.0
ORmoodlemoodleMatch2.1.1
ORmoodlemoodleMatch2.1.2
ORmoodlemoodleMatch2.1.3
ORmoodlemoodleMatch2.1.4
ORmoodlemoodleMatch2.1.5
Node
moodlemoodleMatch2.2.0
ORmoodlemoodleMatch2.2.1
ORmoodlemoodleMatch2.2.2
| Vendor | Product | Version | CPE |
|---|---|---|---|
| moodle | moodle | 2.1.0 | cpe:2.3:a:moodle:moodle:2.1.0:*:*:*:*:*:*:* |
| moodle | moodle | 2.1.1 | cpe:2.3:a:moodle:moodle:2.1.1:*:*:*:*:*:*:* |
| moodle | moodle | 2.1.2 | cpe:2.3:a:moodle:moodle:2.1.2:*:*:*:*:*:*:* |
| moodle | moodle | 2.1.3 | cpe:2.3:a:moodle:moodle:2.1.3:*:*:*:*:*:*:* |
| moodle | moodle | 2.1.4 | cpe:2.3:a:moodle:moodle:2.1.4:*:*:*:*:*:*:* |
| moodle | moodle | 2.1.5 | cpe:2.3:a:moodle:moodle:2.1.5:*:*:*:*:*:*:* |
| moodle | moodle | 2.2.0 | cpe:2.3:a:moodle:moodle:2.2.0:*:*:*:*:*:*:* |
| moodle | moodle | 2.2.1 | cpe:2.3:a:moodle:moodle:2.2.1:*:*:*:*:*:*:* |
| moodle | moodle | 2.2.2 | cpe:2.3:a:moodle:moodle:2.2.2:*:*:*:*:*:*:* |
Related
nvd
nvd
CVE-2012-2357
2012-07-21 03:38:55
ubuntucve
ubuntucve
CVE-2012-2357
2012-07-21 00:00:00
veracode
veracode
Credential Sniffing
2017-05-31 05:56:26
cvelist
cvelist
CVE-2012-2357
2012-07-21 01:00:00
prion
prion
Authentication flaw
2012-07-21 03:38:00
nessus
nessus
Moodle 2.1.x < 2.1.6 / 2.2.x < 2.2.3 Multiple Vulnerabilities
2015-04-20 00:00:00
Fedora 16 : moodle-2.0.9-1.fc16 (2012-8325)
2012-06-04 00:00:00
Fedora 17 : moodle-2.2.3-1.fc17 (2012-8284)
2012-06-04 00:00:00
openvas
openvas
Fedora Update for moodle FEDORA-2012-8284
2012-08-30 00:00:00
Fedora Update for moodle FEDORA-2012-8325
2012-06-04 00:00:00
Fedora Update for moodle FEDORA-2012-8365
2012-06-04 00:00:00
fedora
fedora
[SECURITY] Fedora 17 Update: moodle-2.2.3-1.fc17
2012-06-01 17:01:55
[SECURITY] Fedora 15 Update: moodle-1.9.18-1.fc15
2012-06-02 03:58:35
[SECURITY] Fedora 16 Update: moodle-2.0.9-1.fc16
2012-06-02 03:57:50
CVSS2
5
Attack Vector
NETWORK
Attack Complexity
LOW
Authentication
NONE
Confidentiality Impact
PARTIAL
Integrity Impact
NONE
Availability Impact
NONE
AV:N/AC:L/Au:N/C:P/I:N/A:N
AI Score
6.4
Confidence
Low
EPSS
0.002
Percentile
55.9%
Related for CVE-2012-2357