GitHub Advisoryadvisory · Packagist

GHSA-2hw2-h3mf-c2j9 Moodle open redirect vulnerability

HIGH Published 2022-05-13 Modified 2024-01-26 Official page ↗
Aliases
CVE-2015-3272
Ecosystem
Packagist
Packages
moodle/moodle
Severity
High
CVSS vector
CVSS:3.0/AV:N/AC:L/PR:N/UI:R/S:C/C:N/I:H/A:N
Reviewed
2024-01-26

Affected packages

• Packagist moodle/moodle: >= 2.7.0, < 2.7.9 → fixed in 2.7.9 • Packagist moodle/moodle: >= 2.8.0, < 2.8.7 → fixed in 2.8.7 • Packagist moodle/moodle: >= 2.9.0, < 2.9.1 → fixed in 2.9.1

Description

Open redirect vulnerability in the clean_param function in lib/moodlelib.php in Moodle through 2.6.11, 2.7.x before 2.7.9, 2.8.x before 2.8.7, and 2.9.x before 2.9.1 allows remote attackers to redirect users to arbitrary web sites and conduct phishing attacks via vectors involving an HTTP Referer header that has a substring match with a local URL.

Related

Alias · CVE (1)

  • CVE-2015-3272 Open redirect vulnerability in the clean_param function in lib/moodlelib.php in Moodle through 2.6.11, 2.7.x before 2.7.9, 2.8.x before… vulnerability

References