CVE-2009-4302

MediumCVSS 5.0/10Last modified Jun 16, 2026

Description

login/index_form.html in Moodle 1.8 before 1.8.11 and 1.9 before 1.9.7 links to an index page on the HTTP port even when the page is served from an HTTPS port, which might cause login credentials to be sent in cleartext, even when SSL is intended, and allows remote attackers to obtain these credentials by sniffing.

Metrics

CVSS 2.0 5.0/10AV:N/AC:L/Au:N/C:P/I:N/A:N

Weakness enumeration

CWE-310

Affected software

Vendor	Product	Versions
n/a	n/a	n/a

References

http://docs.moodle.org/en/Moodle_1.8.11_release_notesPatch
http://docs.moodle.org/en/Moodle_1.9.7_release_notesPatch
http://moodle.org/mod/forum/discuss.php?d=139107Patch, Vendor Advisory
http://secunia.com/advisories/37614Vendor Advisory
http://www.securityfocus.com/bid/37244Patch
http://www.vupen.com/english/advisories/2009/3455Patch, Vendor Advisory
https://www.redhat.com/archives/fedora-package-announce/2009-December/msg00704.htmlPatch
https://www.redhat.com/archives/fedora-package-announce/2009-December/msg00730.htmlPatch
https://www.redhat.com/archives/fedora-package-announce/2009-December/msg00751.htmlPatch
http://docs.moodle.org/en/Moodle_1.8.11_release_notesPatch
http://docs.moodle.org/en/Moodle_1.9.7_release_notesPatch
http://moodle.org/mod/forum/discuss.php?d=139107Patch, Vendor Advisory
http://secunia.com/advisories/37614Vendor Advisory
http://www.securityfocus.com/bid/37244Patch
http://www.vupen.com/english/advisories/2009/3455Patch, Vendor Advisory
https://www.redhat.com/archives/fedora-package-announce/2009-December/msg00704.htmlPatch
https://www.redhat.com/archives/fedora-package-announce/2009-December/msg00730.htmlPatch
https://www.redhat.com/archives/fedora-package-announce/2009-December/msg00751.htmlPatch

Timeline

Published: Dec 16, 2009
Last modified: Jun 16, 2026
NVD status: Modified

Related CVEs from 2009

CVE-2009-43035.0Moodle 1.8 before 1.8.11 and 1.9 before 1.9.7 stores (1) password hashes and (2) unspecified "secrets" in backup files, which might allow at CVE-2009-43047.5Moodle 1.8 before 1.8.11 and 1.9 before 1.9.7 does not use a random password salt in config.php, which makes it easier for attackers to cond CVE-2009-43056.5SQL injection vulnerability in the SCORM module in Moodle 1.8 before 1.8.11 and 1.9 before 1.9.7 allows remote authenticated users to execut CVE-2009-43064.9Unspecified vulnerability in the EXT4_IOC_MOVE_EXT (aka move extents) ioctl implementation in the ext4 filesystem in the Linux kernel 2.6.32 CVE-2009-43077.1The ext4_fill_flex_info function in fs/ext4/super.c in the Linux kernel before 2.6.32-git6 allows user-assisted remote attackers to cause a CVE-2009-43087.1The ext4_decode_error function in fs/ext4/super.c in the ext4 filesystem in the Linux kernel before 2.6.32 allows user-assisted remote attac CVE-2009-43099.3Heap-based buffer overflow in the Intel Indeo41 codec for Windows Media Player in Microsoft Windows 2000 SP4, XP SP2 and SP3, and Server 200 CVE-2009-43109.3Stack-based buffer overflow in the Intel Indeo41 codec for Windows Media Player in Microsoft Windows 2000 SP4, XP SP2 and SP3, and Server 20 CVE-2009-43119.3Unspecified vulnerability in the Indeo codec in Microsoft Windows 2000 SP4, XP SP2 and SP3, and Server 2003 SP2 allows remote attackers to e CVE-2009-43129.3Unspecified vulnerability in the Indeo codec in Microsoft Windows 2000 SP4, XP SP2 and SP3, and Server 2003 SP2 allows remote attackers to e CVE-2009-43139.3ir32_32.dll 3.24.15.3 in the Indeo32 codec in Microsoft Windows 2000 SP4, XP SP2 and SP3, and Server 2003 SP2 allows remote attackers to cau CVE-2009-43144.4Sun Ray Server Software 4.1 on Solaris 10, when Automatic Multi-Group Hotdesking (AMGH) is enabled, responds to a logout action by immediate