GHSA-78fm-qhh8-8858

Moodle reflected XSS

En bref

Publiée: 2022-03-12 00:00 UTC
Mise à jour: 2024-02-16 08:23 UTC
CVE: CVE-2021-32478
Alias: BIT-moodle-2021-32478
CVSS_V3: CVSS:3.1/AV:N/AC:L/PR:N/UI:R/S:C/C:L/I:L/A:N

Description

The redirect URI in the LTI authorization endpoint required extra sanitizing to prevent reflected XSS and open redirect risks. Moodle versions 3.10 to 3.10.3, 3.9 to 3.9.6, 3.8 to 3.8.8 and earlier unsupported versions are affected.

Paquets affectés

Paquet	Versions
Packagist · moodle/moodle	introduced 3.10, fixed 3.10.4
Packagist · moodle/moodle	introduced 3.9, fixed 3.9.7
Packagist · moodle/moodle	introduced 3.8, fixed 3.8.9

Références

https://nvd.nist.gov/vuln/detail/CVE-2021-32478 ADVISORY
https://github.com/moodle/moodle/commit/752ad3d8eb4f9ac22dbf1461aa69d6e0baee503e WEB
https://moodle.org/mod/forum/discuss.php?d=422314 WEB

Sources

Source	Licence
OSV.dev	CC-BY 4.0 — GitHub Advisory Database