Description

lib/db/upgrade.php in Moodle 2.0.x before 2.0.5 and 2.1.x before 2.1.2 does not set the correct registration_hubs.secret value during installation, which allows remote attackers to bypass intended access restrictions by leveraging the hubs feature.

Remediation

References

CVE-2011-4303

Related Vulnerabilities

MySQL CVE-2015-0505 Vulnerability (CVE-2015-0505)

MediaWiki Use of Hard-coded Credentials Vulnerability (CVE-2012-4381)

Oracle Database Server CVE-2010-0870 Vulnerability (CVE-2010-0870)

WordPress Plugin BuddyBoss Media Cross-Site Scripting (3.0.3)

PHP Improper Input Validation Vulnerability (CVE-2014-5120)

Severity

Medium

Classification

CVE-2011-4303

Tags

Missing Update Known Vulnerabilities