CVE-2011-4587
Last modified
CVE-2011-4587 is a vulnerability of currently unknown severity. lib/moodlelib.php in Moodle 1.9.x before 1.9.15, 2.0.x before 2.0.6, and 2.1.x before 2.1.3 does not properly handle certain zero values in the password policy, which makes it easier for remote attackers to obtain access by leveraging the possible existence of user accounts that have unchangeable blank passwords.. EPSS estimates a 2.07% chance of exploitation in the next 30 days.
Description
lib/moodlelib.php in Moodle 1.9.x before 1.9.15, 2.0.x before 2.0.6, and 2.1.x before 2.1.3 does not properly handle certain zero values in the password policy, which makes it easier for remote attackers to obtain access by leveraging the possible existence of user accounts that have unchangeable blank passwords.
Metrics
Weakness Enumeration
Affected Software
| Vendor | Product | Versions |
|---|---|---|
| Moodle | Moodle | 1.9.1 |
| Moodle | Moodle | 1.9.2 |
| Moodle | Moodle | 1.9.3 |
| Moodle | Moodle | 1.9.4 |
| Moodle | Moodle | 1.9.5 |
| Moodle | Moodle | 1.9.6 |
| Moodle | Moodle | 1.9.7 |
| Moodle | Moodle | 1.9.8 |
| Moodle | Moodle | 1.9.9 |
| Moodle | Moodle | 1.9.10 |
| Moodle | Moodle | 1.9.11 |
| Moodle | Moodle | 1.9.12 |
| Moodle | Moodle | 1.9.13 |
| Moodle | Moodle | 1.9.14 |
| Moodle | Moodle | 2.0.0 |
| Moodle | Moodle | 2.0.1 |
| Moodle | Moodle | 2.0.2 |
| Moodle | Moodle | 2.0.3 |
| Moodle | Moodle | 2.0.4 |
| Moodle | Moodle | 2.0.5 |
| Moodle | Moodle | 2.1.0 |
| Moodle | Moodle | 2.1.1 |
| Moodle | Moodle | 2.1.2 |
References
- http://moodle.org/mod/forum/discuss.php?d=191755Vendor Advisory
- http://moodle.org/mod/forum/discuss.php?d=191755Vendor Advisory
Timeline
- Published
- Last Modified
- Status
- Modified
Frequently Asked Questions
What is CVE-2011-4587?
How severe is CVE-2011-4587?
How do I fix CVE-2011-4587?
How Strix Helps
- How Strix found a critical auth bypass in etcdStrix autonomously discovered a critical authentication bypass in etcd, later designated CVE-2026-33413.
- Autonomous PentestingAI agents that find and validate exploitable vulnerabilities like this one across your applications.
- PR ReviewsPentest every pull request so vulnerable code is caught before it ships to production.
- AI Penetration TestingHow AI-driven penetration testing continuously covers your attack surface.
Related CVEs from 2011
- CVE-2011-4581mod/wiki/pagelib.php in Moodle 2.0.x before 2.0.6 and 2.1.x …
- CVE-2011-4582Open redirect vulnerability in the Calendar set page in Mood…
- CVE-2011-4583Moodle 2.0.x before 2.0.6 and 2.1.x before 2.1.3 displays we…
- CVE-2011-4584The MNET authentication functionality in Moodle 1.9.x before…
- CVE-2011-4585login/change_password.php in Moodle 1.9.x before 1.9.15 does…
- CVE-2011-4586CRLF injection vulnerability in calendar/set.php in the Cale…
- CVE-2011-4588The ip_in_range function in mnet/lib.php in MNET in Moodle 1…
- CVE-2011-4589backup/moodle2/restore_stepslib.php in Moodle 2.0.x before 2…
- CVE-2011-4590The web services implementation in Moodle 2.0.x before 2.0.6…
- CVE-2011-4591Cross-site scripting (XSS) vulnerability in the print_object…
- CVE-2011-4592The command-line cron implementation in Moodle 2.0.x before …
- CVE-2011-4593Moodle 1.9.x before 1.9.15, 2.0.x before 2.0.6, and 2.1.x be…
Are you affected by CVE-2011-4587?
Run a free Strix scan to check your systems for this vulnerability.
Scan your code nowSource: NVD / NIST