GHSA-78fm-qhh8-8858

ghsaUSosv

Moodle reflected XSS

view advisory published 2022-03-12Licence: CC-BY-4.0

The redirect URI in the LTI authorization endpoint required extra sanitizing to prevent reflected XSS and open redirect risks. Moodle versions 3.10 to 3.10.3, 3.9 to 3.9.6, 3.8 to 3.8.8 and earlier unsupported versions are affected.

describes (1)

Related CVEs.

ID	severity	EPSS	exploitable	published
CVE-2021-32478US	medium6.1	1.13% (66th)	—	2022-03-11
The redirect URI in the LTI authorization endpoint required extra sanitizing to prevent reflected XSS and open redirect risks. Moodle versions 3.10 to 3.10.3, 3.9 to 3.9.6, 3.8 to…

references

External citations — patches, advisories, analysis.

https://github.com/moodle/moodle/commit/752ad3d8eb4f9ac22dbf1461aa69d6e0baee503eWEB
https://moodle.org/mod/forum/discuss.php?d=422314WEB
https://nvd.nist.gov/vuln/detail/CVE-2021-32478ADVISORY

scry

Advisories like this name the exposed products attackers go after on your perimeter. See what is exposed on your perimeter with a free passive scan.

Free scan