GitHub Advisoryadvisory · Packagist

GHSA-hxmp-8f47-x9fc Moodle Open Redirect Via Error Messages

MEDIUM Published 2022-05-13 Modified 2024-01-17 Official page ↗
Aliases
CVE-2011-4294
Ecosystem
Packagist
Packages
moodle/moodle
Severity
Moderate
Weaknesses
CWE-601
Reviewed
2024-01-17

Affected packages

• Packagist moodle/moodle: < 1.9.13 → fixed in 1.9.13 • Packagist moodle/moodle: >= 2.0, < 2.0.4 → fixed in 2.0.4 • Packagist moodle/moodle: >= 2.1, < 2.1.1 → fixed in 2.1.1

Description

The error-message functionality in Moodle 1.9.x before 1.9.13, 2.0.x before 2.0.4, and 2.1.x before 2.1.1 does not ensure that a continuation link refers to an http or https URL for the local Moodle instance, which might allow attackers to trick users into visiting arbitrary web sites via error message links that lead offsite.

Related

Alias · CVE (1)

  • CVE-2011-4294 The error-message functionality in Moodle 1.9.x before 1.9.13, 2.0.x before 2.0.4, and 2.1.x before 2.1.1 does not ensure that a… vulnerability

Weakness · CWE (1)

  • CWE-601 URL Redirection to Untrusted Site weakness

References