Description

lib/db/upgrade.php in Moodle 2.0.x before 2.0.5 and 2.1.x before 2.1.2 does not set the correct registration_hubs.secret value during installation, which allows remote attackers to bypass intended access restrictions by leveraging the hubs feature.

Remediation

References

CVE-2011-4303

Related Vulnerabilities

WordPress Plugin Ninja Forms Contact Form-The Drag and Drop Form Builder for WordPress Multiple Vulnerabilities (2.9.42)

Jboss EAP Improper Limitation of a Pathname to a Restricted Directory ('Path Traversal') Vulnerability (CVE-2018-1048)

MySQL CVE-2019-2607 Vulnerability (CVE-2019-2607)

OpenSSL Other Vulnerability (CVE-2010-4180)

WordPress Improper Neutralization of Input During Web Page Generation ('Cross-site Scripting') Vulnerability (CVE-2015-5714)

Severity

Medium

Classification

CVE-2011-4303

Tags

Missing Update Known Vulnerabilities