Description

Multiple unspecified authentication plugins in Moodle 1.8 before 1.8.11 and 1.9 before 1.9.7 store the MD5 hashes for passwords in the user table, even when the cached hashes are not used by the plugin, which might make it easier for attackers to obtain credentials via unspecified vectors.

Remediation

References

CVE-2009-4300

Related Vulnerabilities

RubyGems Other Vulnerability (CVE-2012-2125)

WordPress Improper Neutralization of Input During Web Page Generation ('Cross-site Scripting') Vulnerability (CVE-2017-9063)

Jenkins Improper Limitation of a Pathname to a Restricted Directory ('Path Traversal') Vulnerability (CVE-2021-21683)

ReviveAdserver Improper Neutralization of Input During Web Page Generation ('Cross-site Scripting') Vulnerability (CVE-2021-22889)

TYPO3 Deserialization of Untrusted Data Vulnerability (CVE-2019-12747)

Severity

Medium

Classification

CVE-2009-4300 CWE-200

Tags

Missing Update Known Vulnerabilities