GitHub Advisoryadvisory · Packagist

GHSA-h798-h7ff-93xv Moodle Arbitrary Redirect

MEDIUM Published 2022-05-13 Modified 2023-12-07 Official page ↗
Aliases
CVE-2015-3175
Ecosystem
Packagist
Packages
moodle/moodle
Severity
Moderate
Weaknesses
CWE-601
Reviewed
2023-08-01

Affected packages

• Packagist moodle/moodle: <= 2.5.9 (no fix yet) • Packagist moodle/moodle: >= 2.6.0, < 2.6.11 → fixed in 2.6.11 • Packagist moodle/moodle: >= 2.7.0, < 2.7.8 → fixed in 2.7.8 • Packagist moodle/moodle: >= 2.8.0, < 2.8.6 → fixed in 2.8.6

Description

Multiple open redirect vulnerabilities in Moodle through 2.5.9, 2.6.x before 2.6.11, 2.7.x before 2.7.8, and 2.8.x before 2.8.6 allow remote attackers to redirect users to arbitrary web sites and conduct phishing attacks via vectors involving an error page that links to a URL from an HTTP Referer header.

Related

Alias · CVE (1)

  • CVE-2015-3175 Multiple open redirect vulnerabilities in Moodle through 2.5.9, 2.6.x before 2.6.11, 2.7.x before 2.7.8, and 2.8.x before 2.8.6 allow… vulnerability

Weakness · CWE (1)

  • CWE-601 URL Redirection to Untrusted Site weakness

References