Auth bypass in Moodle

CVE-2010-1613

Moodle 1.8.x and 1.9.x before 1.9.8 does not enable the "Regenerate session id during login" setting by default, which makes it easier for remote attackers to conduct session fixation attacks.

Vulnerability class: Broken Authentication

EPSS: 0.018 (76.4th percentile) — read the EPSS interpretation.

Affected products

  • Moodle — versions 1.9.6, 1.8.8, 1.8.4
  • N/a — versions n/a

Weakness classification (CWE)

References