Vulnerability Bulletins |
MSA-21-0032: Session Hijack risk when Shibboleth authentication is enabled |
|
| Affected software | PHP |
|
by Michael Hawkins. A session hijack risk was identified in the Shibboleth authentication plugin. (Note: Shibboleth authentication is disabled by default in Moodle.)Severity/Risk:SeriousVersions affected:3.11 to 3.11.2, 3.10 to 3.10.6, 3.9 to 3.9.9 and earlier unsupported versionsVersions fixed:3.11.3, 3.10.7 and 3.9.10Reported by:Robin Peraglie and Johannes MoritzCVE identifier:CVE-2021-40691Changes More info: https://moodle.org/mod/forum/discuss.php?d=427103&parent=1719325 |
|