#VU43837 Credentials management in Moodle - CVE-2011-4587
Vulnerability identifier: #VU43837
Vulnerability risk: Medium
CVSSv4.0: 2.7 [CVSS:4.0/AV:N/AC:L/AT:N/PR:N/UI:N/VC:L/VI:L/VA:L/SC:N/SI:N/SA:N/E:U/U:Green]
CVE-ID: CVE-2011-4587
CWE-ID:
CWE-255
Exploitation vector: Network
Exploit availability: No
Vulnerable software:
Moodle
Web applications /
Other software
Vendor: moodle.org
Description
The vulnerability allows a remote non-authenticated attacker to read and manipulate data.
lib/moodlelib.php in Moodle 1.9.x before 1.9.15, 2.0.x before 2.0.6, and 2.1.x before 2.1.3 does not properly handle certain zero values in the password policy, which makes it easier for remote attackers to obtain access by leveraging the possible existence of user accounts that have unchangeable blank passwords.
Mitigation
Install update from vendor's website.
Vulnerable software versions
Moodle: 1.9 - 1.9.14, 2.0 - 2.0.5, 2.1 - 2.1.2
External links
https://git.moodle.org/gw?p=moodle.git;a=commit;h=e079e82c087becf06d902089d14f3f76686bde19
https://moodle.org/mod/forum/discuss.php?d=191755
https://www.debian.org/security/2012/dsa-2421
https://bugzilla.redhat.com/show_bug.cgi?id=761248
Q & A
Can this vulnerability be exploited remotely?
Yes. This vulnerability can be exploited by a remote non-authenticated attacker via the Internet.
Is there known malware, which exploits this vulnerability?
No. We are not aware of malware exploiting this vulnerability.
