Description
Moodle 1.8 before 1.8.11 and 1.9 before 1.9.7 does not use a random password salt in config.php, which makes it easier for attackers to conduct brute-force password guessing attacks.
Fixed in Linux distributions
Distributions backport fixes, so the version that fixes this vulnerability differs per release — upgrade to at least the version shown. From the distributions' security trackers and advisories.
Debian
Security tracker ↗| Release | Package | Fixed in | Advisory |
|---|---|---|---|
| Debian 5.0 | moodle | 1.8.13-1 | DSA-2115-1 |
Advisories 1
- DSA-2115-1 moodle - several vulnerabilities Debian Security (DSA / DLA) · Mar 9, 2026
References
- http://moodle.org/mod/forum/discuss.php?d=139111
- http://docs.moodle.org/en/Moodle_1.9.7_release_notes
- http://docs.moodle.org/en/Moodle_1.8.11_release_notes
- ADV-2009-3455 vdb-entry
- 37614 third-party-advisory
- FEDORA-2009-13065 vendor-advisory
- FEDORA-2009-13040 vendor-advisory
- FEDORA-2009-13080 vendor-advisory
- 37244 vdb-entry