{"api_version":"1","generated_at":"2026-07-23T05:37:38+00:00","cve":"CVE-2011-4287","urls":{"html":"https://cve.report/CVE-2011-4287","api":"https://cve.report/api/cve/CVE-2011-4287.json","docs":"https://cve.report/api","cve_org":"https://www.cve.org/CVERecord?id=CVE-2011-4287","nvd":"https://nvd.nist.gov/vuln/detail/CVE-2011-4287"},"summary":{"title":"CVE-2011-4287","description":"admin/uploaduser_form.php in Moodle 2.0.x before 2.0.3 does not force password changes for autosubscribed users, which makes it easier for remote attackers to obtain access by leveraging knowledge of the initial password of a new user.","state":"PUBLISHED","assigner":"redhat","published_at":"2012-07-16 10:28:36","updated_at":"2026-04-29 01:13:23"},"problem_types":["CWE-264","n/a"],"metrics":[{"version":"2.0","source":"nvd@nist.gov","type":"Primary","score":"6.8","severity":"","vector":"AV:N/AC:M/Au:N/C:P/I:P/A:P","data":{"version":"2.0","vectorString":"AV:N/AC:M/Au:N/C:P/I:P/A:P","baseScore":6.8,"accessVector":"NETWORK","accessComplexity":"MEDIUM","authentication":"NONE","confidentialityImpact":"PARTIAL","integrityImpact":"PARTIAL","availabilityImpact":"PARTIAL"}}],"references":[{"url":"http://openwall.com/lists/oss-security/2011/11/14/1","name":"http://openwall.com/lists/oss-security/2011/11/14/1","refsource":"af854a3a-2127-422b-91ae-364da2661108","tags":[],"title":"oss-security - Re: Fwd: DSA 2338-1 moodle security update","mime":"text/html","httpstatus":"200","archivestatus":"200"},{"url":"http://moodle.org/mod/forum/discuss.php?d=175588","name":"http://moodle.org/mod/forum/discuss.php?d=175588","refsource":"af854a3a-2127-422b-91ae-364da2661108","tags":["Vendor Advisory"],"title":"Moodle.org: MSA-11-0012: Authentication issue","mime":"text/html","httpstatus":"200","archivestatus":"200"},{"url":"http://git.moodle.org/gw?p=moodle.git%3Ba=commit%3Bh=22a77963439e00441949440f0517135b3a5418da","name":"http://git.moodle.org/gw?p=moodle.git%3Ba=commit%3Bh=22a77963439e00441949440f0517135b3a5418da","refsource":"af854a3a-2127-422b-91ae-364da2661108","tags":[],"title":"Official Moodle git projects - moodle.git/commit","mime":"text/xml","httpstatus":"404","archivestatus":"200"},{"url":"http://git.moodle.org/gw?p=moodle.git;a=commit;h=22a77963439e00441949440f0517135b3a5418da","name":"CONFIRM:http://git.moodle.org/gw?p=moodle.git;a=commit;h=22a77963439e00441949440f0517135b3a5418da","refsource":"MITRE","tags":[],"title":"Official Moodle git projects - moodle.git/commit","mime":"text/xml","httpstatus":"200","archivestatus":"0"},{"url":"https://www.cve.org/CVERecord?id=CVE-2011-4287","name":"CVE Program record","refsource":"CVE.ORG","tags":["canonical"]},{"url":"https://nvd.nist.gov/vuln/detail/CVE-2011-4287","name":"NVD vulnerability detail","refsource":"NVD","tags":["canonical","analysis"]}],"affected":[{"source":"CNA","vendor":"n/a","product":"n/a","version":"affected n/a","platforms":[]}],"timeline":[],"solutions":[],"workarounds":[],"exploits":[],"credits":[],"nvd_cpes":[{"cve_year":"2011","cve_id":"4287","vulnerable":"1","versionEndIncluding":"","cpe1":"cpe","cpe2":"2.3","cpe3":"a","cpe4":"moodle","cpe5":"moodle","cpe6":"2.0.0","cpe7":"*","cpe8":"*","cpe9":"*","cpe10":"*","cpe11":"*","cpe12":"*","cpe13":"*"},{"cve_year":"2011","cve_id":"4287","vulnerable":"1","versionEndIncluding":"","cpe1":"cpe","cpe2":"2.3","cpe3":"a","cpe4":"moodle","cpe5":"moodle","cpe6":"2.0.1","cpe7":"*","cpe8":"*","cpe9":"*","cpe10":"*","cpe11":"*","cpe12":"*","cpe13":"*"},{"cve_year":"2011","cve_id":"4287","vulnerable":"1","versionEndIncluding":"","cpe1":"cpe","cpe2":"2.3","cpe3":"a","cpe4":"moodle","cpe5":"moodle","cpe6":"2.0.2","cpe7":"*","cpe8":"*","cpe9":"*","cpe10":"*","cpe11":"*","cpe12":"*","cpe13":"*"}],"vendor_comments":[],"enrichments":{"kev":null,"epss":null,"legacy_qids":[]},"source_records":{"cve_program":{"containers":{"adp":[{"providerMetadata":{"dateUpdated":"2024-08-07T00:01:51.543Z","orgId":"af854a3a-2127-422b-91ae-364da2661108","shortName":"CVE"},"references":[{"name":"[oss-security] 20111113 Re: Fwd: DSA 2338-1 moodle security update","tags":["mailing-list","x_refsource_MLIST","x_transferred"],"url":"http://openwall.com/lists/oss-security/2011/11/14/1"},{"tags":["x_refsource_CONFIRM","x_transferred"],"url":"http://git.moodle.org/gw?p=moodle.git%3Ba=commit%3Bh=22a77963439e00441949440f0517135b3a5418da"},{"tags":["x_refsource_CONFIRM","x_transferred"],"url":"http://moodle.org/mod/forum/discuss.php?d=175588"}],"title":"CVE Program Container"}],"cna":{"affected":[{"product":"n/a","vendor":"n/a","versions":[{"status":"affected","version":"n/a"}]}],"datePublic":"2011-11-13T00:00:00.000Z","descriptions":[{"lang":"en","value":"admin/uploaduser_form.php in Moodle 2.0.x before 2.0.3 does not force password changes for autosubscribed users, which makes it easier for remote attackers to obtain access by leveraging knowledge of the initial password of a new user."}],"problemTypes":[{"descriptions":[{"description":"n/a","lang":"en","type":"text"}]}],"providerMetadata":{"dateUpdated":"2012-07-25T09:00:00.000Z","orgId":"53f830b8-0a3f-465b-8143-3b8a9948e749","shortName":"redhat"},"references":[{"name":"[oss-security] 20111113 Re: Fwd: DSA 2338-1 moodle security update","tags":["mailing-list","x_refsource_MLIST"],"url":"http://openwall.com/lists/oss-security/2011/11/14/1"},{"tags":["x_refsource_CONFIRM"],"url":"http://git.moodle.org/gw?p=moodle.git%3Ba=commit%3Bh=22a77963439e00441949440f0517135b3a5418da"},{"tags":["x_refsource_CONFIRM"],"url":"http://moodle.org/mod/forum/discuss.php?d=175588"}],"x_legacyV4Record":{"CVE_data_meta":{"ASSIGNER":"secalert@redhat.com","ID":"CVE-2011-4287","STATE":"PUBLIC"},"affects":{"vendor":{"vendor_data":[{"product":{"product_data":[{"product_name":"n/a","version":{"version_data":[{"version_value":"n/a"}]}}]},"vendor_name":"n/a"}]}},"data_format":"MITRE","data_type":"CVE","data_version":"4.0","description":{"description_data":[{"lang":"eng","value":"admin/uploaduser_form.php in Moodle 2.0.x before 2.0.3 does not force password changes for autosubscribed users, which makes it easier for remote attackers to obtain access by leveraging knowledge of the initial password of a new user."}]},"problemtype":{"problemtype_data":[{"description":[{"lang":"eng","value":"n/a"}]}]},"references":{"reference_data":[{"name":"[oss-security] 20111113 Re: Fwd: DSA 2338-1 moodle security update","refsource":"MLIST","url":"http://openwall.com/lists/oss-security/2011/11/14/1"},{"name":"http://git.moodle.org/gw?p=moodle.git;a=commit;h=22a77963439e00441949440f0517135b3a5418da","refsource":"CONFIRM","url":"http://git.moodle.org/gw?p=moodle.git;a=commit;h=22a77963439e00441949440f0517135b3a5418da"},{"name":"http://moodle.org/mod/forum/discuss.php?d=175588","refsource":"CONFIRM","url":"http://moodle.org/mod/forum/discuss.php?d=175588"}]}}}},"cveMetadata":{"assignerOrgId":"53f830b8-0a3f-465b-8143-3b8a9948e749","assignerShortName":"redhat","cveId":"CVE-2011-4287","datePublished":"2012-07-16T10:00:00.000Z","dateReserved":"2011-11-04T00:00:00.000Z","dateUpdated":"2024-08-07T00:01:51.543Z","state":"PUBLISHED"},"dataType":"CVE_RECORD","dataVersion":"5.1"},"nvd":{"publishedDate":"2012-07-16 10:28:36","lastModifiedDate":"2026-04-29 01:13:23","problem_types":["CWE-264","n/a"],"metrics":{"cvssMetricV2":[{"source":"nvd@nist.gov","type":"Primary","cvssData":{"version":"2.0","vectorString":"AV:N/AC:M/Au:N/C:P/I:P/A:P","baseScore":6.8,"accessVector":"NETWORK","accessComplexity":"MEDIUM","authentication":"NONE","confidentialityImpact":"PARTIAL","integrityImpact":"PARTIAL","availabilityImpact":"PARTIAL"},"baseSeverity":"MEDIUM","exploitabilityScore":8.6,"impactScore":6.4,"acInsufInfo":false,"obtainAllPrivilege":false,"obtainUserPrivilege":false,"obtainOtherPrivilege":false,"userInteractionRequired":false}]},"configurations":[{"nodes":[{"operator":"OR","negate":false,"cpeMatch":[{"vulnerable":true,"criteria":"cpe:2.3:a:moodle:moodle:2.0.0:*:*:*:*:*:*:*","matchCriteriaId":"DD248A1D-CACC-4E76-925A-078B736442AE"},{"vulnerable":true,"criteria":"cpe:2.3:a:moodle:moodle:2.0.1:*:*:*:*:*:*:*","matchCriteriaId":"9B8A0403-0869-495F-B7C0-13A387549C7A"},{"vulnerable":true,"criteria":"cpe:2.3:a:moodle:moodle:2.0.2:*:*:*:*:*:*:*","matchCriteriaId":"39791F43-CF89-485B-AA8B-634C282BB025"}]}]}]},"legacy_mitre":{"record":{"CveYear":"2011","CveId":"4287","Ordinal":"1","Title":"CVE-2011-4287","CVE":"CVE-2011-4287","Year":"2011"},"notes":[{"CveYear":"2011","CveId":"4287","Ordinal":"1","NoteData":"admin/uploaduser_form.php in Moodle 2.0.x before 2.0.3 does not force password changes for autosubscribed users, which makes it easier for remote attackers to obtain access by leveraging knowledge of the initial password of a new user.","Type":"Description","Title":"CVE-2011-4287"},{"CveYear":"2011","CveId":"4287","Ordinal":"2","NoteData":"2012-07-16","Type":"Other","Title":"Published"},{"CveYear":"2011","CveId":"4287","Ordinal":"3","NoteData":"2012-07-25","Type":"Other","Title":"Modified"}]}}}