Description (CNA)
login/confirm.php in Moodle through 2.5.9, 2.6.x before 2.6.11, 2.7.x before 2.7.8, and 2.8.x before 2.8.6 allows remote authenticated users to bypass intended login restrictions by leveraging access to an unconfirmed suspended account.
Affected (CNA)
| Vendor / product | Versions |
|---|---|
| n/a / n/a | affected n/a |
CWE
No CWE identifiers supplied.
References
- http://www.securityfocus.com/bid/74725
- https://moodle.org/mod/forum/discuss.php?d=313686
- http://www.securitytracker.com/id/1032358
- http://openwall.com/lists/oss-security/2015/05/18/1
- http://git.moodle.org/gw?p=moodle.git&a=search&h=HEAD&st=commit&s=MDL-50090
ADP enrichment
No English description supplied.