Description

auth/ldap/ntlmsso_attempt.php in Moodle 2.0.x before 2.0.10, 2.1.x before 2.1.7, 2.2.x before 2.2.4, and 2.3.x before 2.3.1 redirects users from an https LDAP login URL to an http URL, which allows remote attackers to obtain sensitive information by sniffing the network.

Remediation

References

CVE-2012-3394

Related Vulnerabilities

IBM RTC Improper Neutralization of Input During Web Page Generation ('Cross-site Scripting') Vulnerability (CVE-2018-1521)

Oracle Application Server Other Vulnerability (CVE-2006-5353)

Sqlite Use After Free Vulnerability (CVE-2020-13871)

Oracle JRE CVE-2012-5073 Vulnerability (CVE-2012-5073)

WordPress Plugin TheCartPress eCommerce Shopping Cart Multiple Vulnerabilities (1.5.3.6)

Severity

Medium

Classification

CVE-2012-3394 CWE-200

Tags

Missing Update Known Vulnerabilities