CVE-2009-4303: Infoleak
Published Dec 16, 2009
·Updated
Moodle 1.8 before 1.8.11 and 1.9 before 1.9.7 stores (1) password hashes and (2) unspecified "secrets" in backup files, which might allow attackers to obtain sensitive information.
Affected Software
15 affected components
Moodle moodle=1.9.4
Moodle moodle=1.9.1
Moodle moodle=1.8.8
Moodle moodle=1.9.6
Moodle moodle=1.8.2
Moodle moodle=1.9.2
Moodle moodle=1.8.5
Moodle moodle=1.8.3
Moodle moodle=1.8.9
Moodle moodle=1.8.7
Moodle moodle=1.8.10
Moodle moodle=1.9.3
Moodle moodle=1.9.5
Moodle moodle=1.8.4
Moodle moodle=1.8.1
Remediation
Patch Available
Patch Available
Patch Available
Patch Available
Patch Available
Event History
Dec 16, 2009
CVE Published
via MITRE·01:00 AM
Data Sourced
via MITRE·01:00 AM
Description
Frequently Asked Questions
1
What is the severity of CVE-2009-4303?
CVE-2009-4303 is classified as a high severity vulnerability due to the exposure of sensitive information including password hashes.
2
How do I fix CVE-2009-4303?
To remediate CVE-2009-4303, upgrade Moodle to version 1.8.11 or 1.9.7 or later.
3
What versions of Moodle are affected by CVE-2009-4303?
Moodle versions 1.8 before 1.8.11 and 1.9 before 1.9.7 are affected by CVE-2009-4303.
4
What happens if I do not address CVE-2009-4303?
Failing to address CVE-2009-4303 may allow attackers to obtain sensitive information from your Moodle backup files.
5
Is CVE-2009-4303 specific to certain Moodle installations?
Yes, CVE-2009-4303 specifically affects certain versions of Moodle, particularly 1.8 and 1.9 before specified updates.