Description

The MNET authentication functionality in Moodle 1.9.x before 1.9.15, 2.0.x before 2.0.6, and 2.1.x before 2.1.3 allows remote authenticated users to impersonate other user accounts by using the Login As feature in conjunction with a remote MNET single sign-on capability, as demonstrated by a Mahara site.

Remediation

References

CVE-2011-4584

Related Vulnerabilities

Plone CMS Improper Neutralization of Input During Web Page Generation ('Cross-site Scripting') Vulnerability (CVE-2011-1340)

WordPress Plugin Simpel Reserveren 3 Cross-Site Scripting (3.5.2)

WordPress Plugin Redirect 404 Error Page to Homepage or Custom Page with Logs Cross-Site Request Forgery (1.7.8)

osCommerce Unrestricted Upload of File with Dangerous Type Vulnerability (CVE-2018-18572)

WordPress Plugin The Official Facebook Chat Security Bypass (1.5)

Severity

Medium

Classification

CVE-2011-4584 CWE-264

Tags

Missing Update Known Vulnerabilities