Detections
Analytics

CVE-2010-1613

critical

Description

Moodle 1.8.x and 1.9.x before 1.9.8 does not enable the "Regenerate session id during login" setting by default, which makes it easier for remote attackers to conduct session fixation attacks.

References

http://www.vupen.com/english/advisories/2010/1107

http://moodle.org/security/

http://lists.opensuse.org/opensuse-security-announce/2010-05/msg00001.html

Details

Source: Mitre, NVD

Published: 2010-04-29

Updated: 2020-12-01

Risk Information

CVSS v2

Base Score: 6.8

Vector: CVSS2#AV:N/AC:M/Au:N/C:P/I:P/A:P

Severity: Medium

CVSS v3

Base Score: 9.1

Vector: CVSS:3.0/AV:N/AC:L/PR:N/UI:N/S:U/C:H/I:H/A:N

Severity: Critical