~ / search / GHSA-243v-5pff-qqfj

GHSA-243v-5pff-qqfj

Moodle Open redirect risk in mobile auto-login feature

Source: GitHub Advisory Database (reviewed) Moderate CVE-2022-35652

Packages

EcosystemPackageAffectedFixed in
Packagist moodle/moodle >= 4.0, < 4.0.2 4.0.2
Packagist moodle/moodle >= 3.11, < 3.11.8 3.11.8
Packagist moodle/moodle >= 3.9, < 3.9.15 3.9.15

Details

As written in the advisory (Markdown source, shown as plain text).

An open redirect issue was found in Moodle due to improper sanitization of user-supplied data in mobile auto-login feature. A remote attacker can create a link that leads to a trusted website, however, when clicked, it redirects the victims to arbitrary URL/domain. Successful exploitation of this vulnerability may allow a remote attacker to perform a phishing attack and steal potentially sensitive information.

References

External links from the advisory. They lead to third-party sites.