low3.5
CVE-2015-3179
login/confirm.php in Moodle through 2.5.9, 2.6.x before 2.6.11, 2.7.x before 2.7.8, and 2.8.x before 2.8.6 allows remote authenticated users to bypass intended…
Impact
login/confirm.php in Moodle through 2.5.9, 2.6.x before 2.6.11, 2.7.x before 2.7.8, and 2.8.x before 2.8.6 allows remote authenticated users to bypass intended login restrictions by leveraging access to an unconfirmed suspended account.
Affected products
| Vendor | Product | Affected versions |
|---|---|---|
| Moodle | Moodle | through 2.5.9 Versions 2.5.0, 2.5.1, 2.5.2, 2.5.3, 2.5.4 |
Weakness classification
References
- NVD record
- CVE.org record
- http://git.moodle.org/gw?p=moodle.git&a=search&h=HEAD&st=commit&s=MDL-50090
- http://openwall.com/lists/oss-security/2015/05/18/1
- http://www.securityfocus.com/bid/74725
- http://www.securitytracker.com/id/1032358
- https://moodle.org/mod/forum/discuss.php?d=313686
- http://git.moodle.org/gw?p=moodle.git&a=search&h=HEAD&st=commit&s=MDL-50090
- http://openwall.com/lists/oss-security/2015/05/18/1
- http://www.securityfocus.com/bid/74725
- http://www.securitytracker.com/id/1032358
- https://moodle.org/mod/forum/discuss.php?d=313686