CVE-2021-36394

In Moodle, a remote code execution risk was identified in the Shibboleth authentication plugin...

CVE-2021-36394: Session Fixation

In Moodle, a remote code execution risk was identified in the Shibboleth authentication plugin...

CVE-2021-40691: Undefined Security Weakness

A session hijack risk was identified in the Shibboleth authentication plugin...

PT-2022-11300 · Shibboleth +1 · Shibboleth Authentication Plugin +1

Name of the Vulnerable Software and Affected Versions: Shibboleth authentication plugin affected versions not specified Description: A session hijack risk was identified in the Shibboleth authentication plugin. Recommendations: At the moment, there is no information about a newer version that...

CVE-2014-3552

The Shibboleth authentication plugin in auth/shibboleth/index.php in Moodle through 2.3.11, 2.4.x before 2.4.11, and 2.5.x before 2.5.7 does not check whether a session ID is empty, which allows remote authenticated users to hijack sessions via crafted plugin interaction...

PT-2014-5390

Name of the Vulnerable Software and Affected Versions Moodle versions prior to 2.3.11 Moodle versions 2.4.x prior to 2.4.11 Moodle versions 2.5.x prior to 2.5.7 Description The issue concerns the Shibboleth authentication plugin in Moodle, which fails to check if a session ID is empty. This allow...