CVE-2011-4582: Moodle Open Redirect in Calendar Set Page
Summary
CVE-2011-4582: Moodle Open Redirect in Calendar Set Page. Affects moodle/moodle versions >= 2.1, < 2.1.3. Fixed in 2.1.3. How to fix ↓
Check if this vulnerability affects your application
Upload a manifest or SBOM and we'll show whether you're affected, plus every other risky package in the same scan.
No signup required · Results in about 60 seconds
Background
Moodle is an open-source learning management system (LMS) used for creating and delivering online courses. It provides a wide range of features for educators and learners, including course management, content creation, and communication tools. The Calendar set page in Moodle version 2.1.x before 2.1.3 is susceptible to an open redirect vulnerability. This vulnerability allows remote authenticated users to redirect users to arbitrary websites, potentially leading to phishing attacks.
Vulnerability Detail
The open redirect vulnerability in the Calendar set page of Moodle 2.1.x before 2.1.3 enables authenticated users to manipulate the redirection URL and redirect users to malicious websites. By crafting a specially crafted URL, an attacker can trick users into visiting a phishing site that appears legitimate. This can result in the theft of sensitive information, such as login credentials or personal data. The vulnerability is rated as moderate severity.
How To Fix
Minimum fixed version
2.1.3
This is the first release that contains the fix.
composer require moodle/moodle:2.1.3Tip — Not sure which version your app runs? Vulert can match this fix to it. Scan free →
Workaround
There is no known workaround for this vulnerability. It is essential to apply the official patch or upgrade to a fixed version of Moodle to eliminate the risk of exploitation.
Conclusion
The open redirect vulnerability in the Calendar set page of Moodle 2.1.x before 2.1.3 can be mitigated by upgrading to the latest stable release or applying the official patch. It is crucial to take action to protect user data and prevent potential phishing attacks. For further support on vulnerability remediation, contact DevNack.com.
See every vulnerability recorded for moodle/moodle →
FAQ
Moodle is an open-source learning management system used for creating and delivering online courses.
An open redirect vulnerability allows an attacker to redirect users to arbitrary websites by manipulating a redirection URL.
This vulnerability can be exploited for phishing attacks, leading to the theft of sensitive information or the compromise of user accounts.
No, it is necessary to apply the official patch or upgrade to a fixed version of Moodle to mitigate the risk.
To fix this vulnerability, upgrade to Moodle version 2.1.3 or later, which includes a patch for the open redirect vulnerability.
References
Related vulnerabilities
Recent vulnerabilities recorded for moodle/moodle.
