An open redirect issue was found in Moodle due to improper sanitization of user-supplied data in mobile auto-login feature. A remote attacker can create a link that leads to a trusted website, however, when clicked, it redirects the victims to arbitrary URL/domain. Successful exploitation of this vulnerability may allow a remote attacker to perform a phishing attack and steal potentially sensitive information.
2022-07-25T16:15:08.463
2024-11-21T07:11:26.470
Modified
CVSSv3.1: 6.1 (MEDIUM)
| Type | Vendor | Product | Version/Range | Vulnerable? |
|---|---|---|---|---|
| Application | moodle | moodle | < 3.9.15 | Yes |
| Application | moodle | moodle | < 3.11.8 | Yes |
| Application | moodle | moodle | < 4.0.2 | Yes |
| Operating System | fedoraproject | fedora | 35 | Yes |
| Operating System | fedoraproject | fedora | 36 | Yes |