| Package | Affected versions | Patched versions |
|---|---|---|
| moodle | = 1.9.1= 1.9.10= 1.9.11= 1.9.12= 1.9.13= 1.9.14= 1.9.2= 1.9.3= 1.9.4= 1.9.5= 1.9.6= 1.9.7= 1.9.8= 1.9.9 |
login/change_password.php in Moodle 1.9.x before 1.9.15 does not use https for the change-password form even if the httpslogin option is enabled, which allows remote attackers to obtain credentials by sniffing the network.
Running one of these products? Scan your site to see whether it exposes a vulnerable version.
Scan my site free