CVE-2009-4300

Description

Multiple unspecified authentication plugins in Moodle 1.8 before 1.8.11 and 1.9 before 1.9.7 store the MD5 hashes for passwords in the user table, even when the cached hashes are not used by the plugin, which might make it easier for attackers to obtain credentials via unspecified vectors.

References

https://www.redhat.com/archives/fedora-package-announce/2009-December/msg00751.html

https://www.redhat.com/archives/fedora-package-announce/2009-December/msg00730.html

https://www.redhat.com/archives/fedora-package-announce/2009-December/msg00704.html

http://www.vupen.com/english/advisories/2009/3455

http://www.securityfocus.com/bid/37244

http://secunia.com/advisories/37614

http://moodle.org/mod/forum/discuss.php?d=139105

http://docs.moodle.org/en/Moodle_1.9.7_release_notes

http://docs.moodle.org/en/Moodle_1.8.11_release_notes

Details

Source: Mitre, NVD

Risk Information

CVSS v2

CVSS v3