GitHub Advisoryadvisory · Packagist

GHSA-3fj7-9j8m-7r8g Moodle Stored HTML in assignment submission comments allowed links to be opened directly

MEDIUM Published 2022-05-13 Modified 2024-01-26 Official page ↗
Aliases
CVE-2019-3850
Ecosystem
Packagist
Packages
moodle/moodle
Severity
Moderate
CVSS vector
CVSS:3.0/AV:N/AC:L/PR:N/UI:R/S:C/C:L/I:L/A:N
Weaknesses
CWE-601
Reviewed
2024-01-26

Affected packages

• Packagist moodle/moodle: < 3.1.17 → fixed in 3.1.17 • Packagist moodle/moodle: >= 3.2.0, < 3.4.8 → fixed in 3.4.8 • Packagist moodle/moodle: >= 3.5.0, < 3.5.5 → fixed in 3.5.5 • Packagist moodle/moodle: >= 3.6.0, < 3.6.3 → fixed in 3.6.3

Description

A vulnerability was found in moodle before versions 3.6.3, 3.5.5, 3.4.8 and 3.1.17. Links within assignment submission comments would open directly (in the same window). Although links themselves may be valid, opening within the same window and without the no-referrer header policy made them more susceptible to exploits.

Related

Alias · CVE (1)

  • CVE-2019-3850 A vulnerability was found in moodle before versions 3.6.3, 3.5.5, 3.4.8 and 3.1.17. vulnerability

Weakness · CWE (1)

  • CWE-601 URL Redirection to Untrusted Site weakness

References