GHSA-243v-5pff-qqfjMediumCVSS 6.1

Moodle Open redirect risk in mobile auto-login feature

Published
July 26, 2022
Last Modified
April 24, 2024

🔗 CVE IDs covered (1)

CVE-2022-35652 →

📋 Description

An open redirect issue was found in Moodle due to improper sanitization of user-supplied data in mobile auto-login feature. A remote attacker can create a link that leads to a trusted website, however, when clicked, it redirects the victims to arbitrary URL/domain. Successful exploitation of this vulnerability may allow a remote attacker to perform a phishing attack and steal potentially sensitive information.

🎯 Affected products3

  • composer/moodle/moodle:>= 4.0, < 4.0.2
  • composer/moodle/moodle:>= 3.11, < 3.11.8
  • composer/moodle/moodle:>= 3.9, < 3.9.15

🔗 References (7)