Moole Vulnerability Database

Find real vulnerabilities before they ship

Unknown

CVE-2010-1613

Moodle 1.8.x and 1.9.x before 1.9.8 does not enable the "Regenerate session id during login" setting by default, which makes it easier for remote attackers to conduct session fixation attacks.

PublishedApr 29, 2010, 21:30

Published Bycve@mitre.org

Affected Versions

Package (Ecosystem)IntroducedFixedLimit

moodle/moodle(Packagist)1.8.01.9.8N/A

References

http://lists.opensuse.org/opensuse-security-announce/2010-05/msg00001.html
http://moodle.org/security/
http://www.vupen.com/english/advisories/2010/1107

Weakness Type

CWE-287

CVSS Metrics

Base Score

6.8

Vector String

AV:N/AC:M/Au:N/C:P/I:P/A:P

Base SeverityUnknown

Version

2.0

Attack Vector (AV)