Description

The web services implementation in Moodle 2.0.x before 2.0.6 and 2.1.x before 2.1.3 does not properly consider the maintenance-mode state and account attributes during login attempts, which allows remote authenticated users to bypass intended access restrictions by connecting to a webservice server.

Remediation

References

CVE-2011-4590

Related Vulnerabilities

MyBB Improper Privilege Management Vulnerability (CVE-2018-1000503)

Apache HTTP Server Other Vulnerability (CVE-2001-1449)

WordPress Plugin WP Font Awesome Cross-Site Scripting (1.7.8)

Joomla Improper Neutralization of Input During Web Page Generation ('Cross-site Scripting') Vulnerability (CVE-2017-9934)

WordPress Plugin WP Limit Posts Automatically Cross-Site Request Forgery (0.7)

Severity

Medium

Classification

CVE-2011-4590 CWE-287

Tags

Missing Update Known Vulnerabilities