VulnerabilityModified

CVE-2009-4302

login/index_form.html in Moodle 1.8 before 1.8.11 and 1.9 before 1.9.7 links to an index page on the HTTP port even when the page is served from an HTTPS port, which might cause login credentials to be sent in cleartext, even when SSL is intended, and…

MEDIUM 5.0EPSS 2.57%

Does this matter?

Lower severity and a low EPSS score (2.57%). Track it; it rarely justifies an emergency change on its own.

Description

CVSS 2.0: 5.0 MEDIUMAV:N/AC:L/Au:N/C:P/I:N/A:N
EPSS: 2.57% probability · 84th percentile
CISA KEV: Not listed
Weakness: CWE-310
Affected: moodle/moodle
Source: cve@mitre.org

References

http://docs.moodle.org/en/Moodle_1.8.11_release_notesPatch
http://docs.moodle.org/en/Moodle_1.9.7_release_notesPatch
http://moodle.org/mod/forum/discuss.php?d=139107Patch, Vendor Advisory
http://secunia.com/advisories/37614Vendor Advisory
http://www.securityfocus.com/bid/37244Patch
http://www.vupen.com/english/advisories/2009/3455Patch, Vendor Advisory
https://www.redhat.com/archives/fedora-package-announce/2009-December/msg00704.htmlPatch
https://www.redhat.com/archives/fedora-package-announce/2009-December/msg00730.htmlPatch
https://www.redhat.com/archives/fedora-package-announce/2009-December/msg00751.htmlPatch
http://docs.moodle.org/en/Moodle_1.8.11_release_notesPatch
http://docs.moodle.org/en/Moodle_1.9.7_release_notesPatch
http://moodle.org/mod/forum/discuss.php?d=139107Patch, Vendor Advisory
http://secunia.com/advisories/37614Vendor Advisory
http://www.securityfocus.com/bid/37244Patch
http://www.vupen.com/english/advisories/2009/3455Patch, Vendor Advisory
https://www.redhat.com/archives/fedora-package-announce/2009-December/msg00704.htmlPatch
https://www.redhat.com/archives/fedora-package-announce/2009-December/msg00730.htmlPatch
https://www.redhat.com/archives/fedora-package-announce/2009-December/msg00751.htmlPatch

Source: NVD record, EPSS from FIRST.org, KEV from CISA. Refreshed daily.