CVE-2011-4287

2012-07-1610:00:00

redhat

www.cve.org

AI Score

6.6

Confidence

Low

EPSS

0.005

Percentile

76.9%

JSON

admin/uploaduser_form.php in Moodle 2.0.x before 2.0.3 does not force password changes for autosubscribed users, which makes it easier for remote attackers to obtain access by leveraging knowledge of the initial password of a new user.

References

git.moodle.org/gw?p=moodle.git%3Ba=commit%3Bh=22a77963439e00441949440f0517135b3a5418da

moodle.org/mod/forum/discuss.php?d=175588

openwall.com/lists/oss-security/2011/11/14/1