Description

The web services implementation in Moodle 2.0.x before 2.0.6 and 2.1.x before 2.1.3 does not properly consider the maintenance-mode state and account attributes during login attempts, which allows remote authenticated users to bypass intended access restrictions by connecting to a webservice server.

Remediation

References

CVE-2011-4590

Related Vulnerabilities

MediaWiki Improper Neutralization of Input During Web Page Generation ('Cross-site Scripting') Vulnerability (CVE-2008-4408)

Moodle Incorrect Authorization Vulnerability (CVE-2022-0984)

WordPress Plugin Post SMTP-WP SMTP with Email Logs & Mobile App for Failure Alerts-Any SMTP Plus Gmail SMTP, Office 365, Brevo, Mailgun, Amazon SES, Postmark Cross-Site Scripting (2.5.7)

WordPress Plugin Login Widget With Shortcode Cross-Site Request Forgery (3.1.1)

Drupal Core 5.x Multiple Vulnerabilities (5.0 - 5.7)

Severity

Medium

Classification

CVE-2011-4590 CWE-287

Tags

Missing Update Known Vulnerabilities