CVE-2015-3179
login/confirm.php in Moodle through 2.5.9, 2.6.x before 2.6.11, 2.7.x before 2.7.8, and 2.8.x before 2.8.6 allows remote authenticated users to bypass intended login restrictions by leveraging access to an unconfirmed suspended account.
- Score
- CVSS 2.0 3.5 Low
- Status
- Modified - secalert@redhat.com
- Published
- 2015-06-01
- Last modified
- 2024-08-06
- Weaknesses
- CWE-264
Affected products
References
- http://git.moodle.org/gw?p=moodle.git&a=search&h=HEAD&st=commit&s=MDL-50090
- http://openwall.com/lists/oss-security/2015/05/18/1
- http://www.securityfocus.com/bid/74725
- http://www.securitytracker.com/id/1032358
- https://moodle.org/mod/forum/discuss.php?d=313686
