CVE-2011-4294: Moodle Open Redirect Via Error Messages
Summary
CVE-2011-4294: Moodle Open Redirect Via Error Messages. Affects moodle/moodle across 3 version ranges.
< 1.9.13
>= 2.0, < 2.0.4
>= 2.1, < 2.1.1
Fixed in 1.9.13, 2.0.4 or 2.1.1, depending on the release line you run. How to fix ↓
Check if this vulnerability affects your application
Upload a manifest or SBOM and we'll show whether you're affected, plus every other risky package in the same scan.
No signup required · Results in about 60 seconds
Background
Moodle is an open-source learning management system (LMS) used by educational institutions worldwide. It provides a platform for creating and delivering online courses, managing student enrollment, and facilitating communication between teachers and students. Moodle is written in PHP and utilizes a database backend for storing course content, user information, and other data. This vulnerability affects Moodle versions 1.9.x, 2.0.x, and 2.1.x.
Vulnerability Detail
The error-message functionality in Moodle versions 1.9.x before 1.9.13, 2.0.x before 2.0.4, and 2.1.x before 2.1.1 does not properly validate continuation links, allowing attackers to exploit an open redirect vulnerability. By crafting malicious error messages with specially crafted continuation links, an attacker can trick users into visiting arbitrary websites. This can lead to various attacks, such as phishing attempts or the execution of malicious scripts on the user's system.
How To Fix
Fixed versions by release line
The minimum fixed version depends on the release line you run.
-
< 1.9.131.9.13composer require moodle/moodle:1.9.13 -
>= 2.0, < 2.0.42.0.4composer require moodle/moodle:2.0.4 -
>= 2.1, < 2.1.12.1.1composer require moodle/moodle:2.1.1
Tip — Not sure which release line you're on? Vulert can find the fix for the version you are using. Scan free →
Workaround
If upgrading to the latest version of Moodle is not immediately possible, a temporary workaround is to disable the display of error messages to users. This can be done by modifying the Moodle configuration settings to suppress error messages or redirect them to a secure internal page. However, this workaround may impact the user experience and should only be used as a temporary measure until the system can be upgraded.
Conclusion
The Moodle Open Redirect Via Error Messages vulnerability allows attackers to exploit an open redirect vulnerability by tricking users into visiting arbitrary websites. To mitigate this vulnerability, it is recommended to upgrade to the latest version of Moodle. If immediate upgrading is not possible, disabling the display of error messages can serve as a temporary workaround. For further support on vulnerability remediation, please contact DevNack.com.
See every vulnerability recorded for moodle/moodle →
FAQ
Moodle is an open-source learning management system used by educational institutions for online course management and delivery.
This vulnerability affects Moodle versions 1.9.x, 2.0.x, and 2.1.x.
This vulnerability allows attackers to trick users into visiting arbitrary websites, potentially leading to phishing attacks or the execution of malicious scripts.
To fix this vulnerability, upgrade to the latest version of Moodle (1.9.13, 2.0.4, or 2.1.1).
Yes, a temporary workaround is to disable the display of error messages to users.
References
Related vulnerabilities
Recent vulnerabilities recorded for moodle/moodle.
