GitHub Advisoryadvisory · Packagist

GHSA-78fm-qhh8-8858 Moodle reflected XSS

MEDIUM Published 2022-03-12 Modified 2023-07-12 Official page ↗
Aliases
CVE-2021-32478
Ecosystem
Packagist
Packages
moodle/moodle
Severity
Moderate
CVSS vector
CVSS:3.1/AV:N/AC:L/PR:N/UI:R/S:C/C:L/I:L/A:N
Weaknesses
CWE-79
Reviewed
2023-07-12

Affected packages

• Packagist moodle/moodle: >= 3.10, < 3.10.4 → fixed in 3.10.4 • Packagist moodle/moodle: >= 3.9, < 3.9.7 → fixed in 3.9.7 • Packagist moodle/moodle: >= 3.8, < 3.8.9 → fixed in 3.8.9

Description

The redirect URI in the LTI authorization endpoint required extra sanitizing to prevent reflected XSS and open redirect risks. Moodle versions 3.10 to 3.10.3, 3.9 to 3.9.6, 3.8 to 3.8.8 and earlier unsupported versions are affected.

Related

Alias · CVE (1)

  • CVE-2021-32478 The redirect URI in the LTI authorization endpoint required extra sanitizing to prevent reflected XSS and open redirect risks. vulnerability

Weakness · CWE (1)

  • CWE-79 Improper Neutralization of Input During Web Page Generation weakness

References