GHSA-j5rc-cr5w-vfg6

Source

https://github.com/advisories/GHSA-j5rc-cr5w-vfg6

Import Source

https://github.com/github/advisory-database/blob/main/advisories/github-reviewed/2022/05/GHSA-j5rc-cr5w-vfg6/GHSA-j5rc-cr5w-vfg6.json

JSON Data

https://api.osv.dev/v1/vulns/GHSA-j5rc-cr5w-vfg6

Aliases

CVE-2010-1613

Published

2022-05-13T01:13:08Z

Modified

2025-04-11T20:27:15Z

Severity

6.6 (Medium) CVSS_V4 - CVSS:4.0/AV:N/AC:L/AT:N/PR:N/UI:N/VC:N/VI:H/VA:N/SC:N/SI:N/SA:N/E:U CVSS Calculator

Summary

Moodle Session Fixation vulnerability

Details

Moodle 1.8.x and 1.9.x before 1.9.8 does not enable the "Regenerate session id during login" setting by default, which makes it easier for remote attackers to conduct session fixation attacks.

Database specific

{
    "cwe_ids":  [
        "CWE-287",
        "CWE-384"
    ],
    "github_reviewed":  true,
    "github_reviewed_at":  "2025-04-11T20:01:58Z",
    "nvd_published_at":  "2010-04-29T21:30:00Z",
    "severity":  "MODERATE"
}

References

Affected packages

Packagist / moodle/moodle

Package

Name: moodle/moodle
Purl: pkg:composer/moodle/moodle

Affected ranges

Type: ECOSYSTEM
Events: Introduced

1.8.0

Fixed

1.9.8

Database specific

source

"https://github.com/github/advisory-database/blob/main/advisories/github-reviewed/2022/05/GHSA-j5rc-cr5w-vfg6/GHSA-j5rc-cr5w-vfg6.json"