What’s Vulnerable › Vulnerabilities

CVE-2011-4287

• Severity: medium (CVSS 6.8 v2.0)
• Exploited in the wild: not listed in CISA KEV
• EPSS: 2.1% probability of exploitation in the next 30 days
• Public exploit or detection template: none known
• Published: 2012-07-16 · updated 2026-06-16
• Weakness: CWE-264

Description

admin/uploaduser_form.php in Moodle 2.0.x before 2.0.3 does not force password changes for autosubscribed users, which makes it easier for remote attackers to obtain access by leveraging knowledge of the initial password of a new user.

Affected products

• Moodle: 2.0.0, 2.0.1, 2.0.2

References

• http://git.moodle.org/gw?p=moodle.git%3Ba=commit%3Bh=22a77963439e00441949440f0517135b3a5418da
• http://moodle.org/mod/forum/discuss.php?d=175588
• http://openwall.com/lists/oss-security/2011/11/14/1
• http://git.moodle.org/gw?p=moodle.git%3Ba=commit%3Bh=22a77963439e00441949440f0517135b3a5418da
• http://moodle.org/mod/forum/discuss.php?d=175588
• http://openwall.com/lists/oss-security/2011/11/14/1

Get alerted when CVE-2011-4287 or the next vulnerability affects your stack