CVE-2011-4584: Medium severity moodle vulnerability

Published Jul 20, 2012

Updated

The MNET authentication functionality in Moodle 1.9.x before 1.9.15, 2.0.x before 2.0.6, and 2.1.x before 2.1.3 allows remote authenticated users to impersonate other user accounts by using the Login As feature in conjunction with a remote MNET single sign-on capability, as demonstrated by a Mahara site.

Affected Software

23 affected components

Moodle moodle=2.0.2

Moodle moodle=1.9.4

Moodle moodle=1.9.1

Moodle moodle=1.9.6

Moodle moodle=1.9.9

Moodle moodle=2.0.1

Moodle moodle=1.9.11

Moodle moodle=2.1.2

Moodle moodle=2.0.4

Moodle moodle=1.9.2

Moodle moodle=1.9.12

Moodle moodle=1.9.10

Moodle moodle=2.0.3

Moodle moodle=2.1.1

Moodle moodle=1.9.3

Moodle moodle=2.0.5

Moodle moodle=1.9.13

Moodle moodle=1.9.5

Moodle moodle=1.9.14

Moodle moodle=1.9.8

Moodle moodle=1.9.7

Moodle moodle=2.0.0

Moodle moodle=2.1.0

Event History

Jul 20, 2012

CVE Published

via MITRE·10:00 AM

Data Sourced

via MITRE·10:00 AM

Description

Frequently Asked Questions

What is the severity of CVE-2011-4584?

CVE-2011-4584 has a medium severity rating due to the potential for unauthorized account access.

How do I fix CVE-2011-4584?

To fix CVE-2011-4584, upgrade Moodle to version 1.9.15, 2.0.6, or 2.1.3 or later.

Which Moodle versions are affected by CVE-2011-4584?

CVE-2011-4584 affects Moodle versions 1.9.x before 1.9.15, 2.0.x before 2.0.6, and 2.1.x before 2.1.3.

What type of vulnerability is CVE-2011-4584?

CVE-2011-4584 is a remote authentication vulnerability that allows account impersonation.

Can remote users exploit CVE-2011-4584 without authentication?

No, exploitation of CVE-2011-4584 requires remote authenticated users to use the Login As feature.