Vulnerability Monitor

The vendors, products, and vulnerabilities you care about

CVE-2021-32478

The redirect URI in the LTI authorization endpoint required extra sanitizing to prevent reflected XSS and open redirect risks. Moodle versions 3.10 to 3.10.3, 3.9 to 3.9.6, 3.8 to 3.8.8 and earlier unsupported versions are affected.

Published

2022-03-11T18:15:19.587

Last Modified

2024-11-21T06:07:07.007

Status

Modified

Source

[email protected]

Severity

CVSSv3.1: 6.1 (MEDIUM)

CVSSv2 Vector

AV:N/AC:M/Au:N/C:N/I:P/A:N

  • Access Vector: NETWORK
  • Access Complexity: MEDIUM
  • Authentication: NONE
  • Confidentiality Impact: NONE
  • Integrity Impact: PARTIAL
  • Availability Impact: NONE
Exploitability Score

8.6

Impact Score

2.9

Weaknesses
  • Type: Primary
    CWE-79
  • Type: Secondary
    CWE-79
    CWE-601
Affected Vendors & Products
Type Vendor Product Version/Range Vulnerable?
Application moodle moodle < 3.8.9 Yes
Application moodle moodle < 3.9.7 Yes
Application moodle moodle < 3.10.4 Yes
References