CVE-2011-4287: Moodle Package Vulnerability - Password Change Not Enforced for Autosubscribed Users
Summary
CVE-2011-4287: Moodle does not force password changes for autosubscribed users. Affects moodle/moodle versions >= 2.0.0, < 2.0.2. Fixed in 2.0.2. How to fix ↓
Check if this vulnerability affects your application
Upload a manifest or SBOM and we'll show whether you're affected, plus every other risky package in the same scan.
No signup required · Results in about 60 seconds
Background
Moodle is an open-source learning platform designed to provide educators, administrators, and learners with a single robust, secure, and integrated system to create personalized learning environments. It is widely used in educational institutions for course management and online learning. However, certain versions of Moodle have a vulnerability that does not enforce password changes for users who are automatically subscribed to courses, potentially compromising user accounts.
Vulnerability Detail
The vulnerability identified as CVE-2011-4287 exists in the admin/uploaduser_form.php file of Moodle versions 2.0.x prior to 2.0.3. It allows remote attackers to gain unauthorized access to user accounts by exploiting the lack of enforced password changes for new users who are automatically subscribed to courses. This oversight can lead to unauthorized access if an attacker knows the initial password of a new user, thereby posing a moderate security risk.
How To Fix
Minimum fixed version
2.0.2
This is the first release that contains the fix.
composer require moodle/moodle:2.0.2Tip — Not sure which version your app runs? Vulert can match this fix to it. Scan free →
Workaround
As a temporary workaround, administrators can manually enforce password changes for new users by implementing a policy that requires users to change their passwords upon first login. This can be done by configuring user settings in the Moodle administration panel.
Conclusion
The CVE-2011-4287 vulnerability in Moodle highlights the importance of enforcing password changes for new users to prevent unauthorized access. By updating to the patched version and implementing additional security measures, administrators can protect their users and maintain the integrity of their learning environments.
See every vulnerability recorded for moodle/moodle →
FAQ
CVE-2011-4287 is a vulnerability in Moodle that allows unauthorized access to user accounts due to the lack of enforced password changes for autosubscribed users.
Moodle versions 2.0.x prior to 2.0.3 are affected by this vulnerability.
You can use Vulert's playground at Vulert Scanner to check if your application is affected by this vulnerability without requiring any signup.
The primary risk is unauthorized access to user accounts, which can lead to data breaches and compromise user privacy.
Ensure that you update Moodle to the latest version and consider implementing policies that require users to change their passwords upon first login.
Related vulnerabilities
Recent vulnerabilities recorded for moodle/moodle.
