CVE-2019-14882: Moodle open redirect vulnerability
Summary
CVE-2019-14882: Moodle open redirect vulnerability. Affects moodle/moodle across 3 version ranges.
>= 3.5, < 3.5.9
>= 3.6, < 3.6.7
>= 3.7, < 3.7.3
Fixed in 3.5.9, 3.6.7 or 3.7.3, depending on the release line you run. How to fix ↓
Check if this vulnerability affects your application
Upload a manifest or SBOM and we'll show whether you're affected, plus every other risky package in the same scan.
No signup required · Results in about 60 seconds
Habilume
Habit tracker with a companion that grows with you
Complete habits, earn Lume Points, and watch your Lume grow as you stay consistent.
Background
Moodle is an open-source learning management system (LMS) used by educational institutions to create and deliver online courses. It provides a platform for educators to manage and organize course materials, assessments, and communication with students. Moodle is widely adopted and offers a range of features to support online learning. However, versions 3.7 to 3.7.3, 3.6 to 3.6.7, 3.5 to 3.5.9, and earlier are vulnerable to an open redirect vulnerability on the Lesson edit page.
Vulnerability Detail
The open redirect vulnerability in Moodle allows an attacker to craft a malicious URL that redirects users to a different website. This can be exploited to trick users into visiting a malicious site, potentially leading to phishing attacks, the execution of arbitrary code, or the theft of sensitive information. The vulnerability originates from improper input validation and sanitization of user-supplied data in the Lesson edit page. By manipulating certain parameters in the URL, an attacker can bypass security controls and redirect users to a malicious site.
How To Fix
Fixed versions by release line
The minimum fixed version depends on the release line you run.
-
>= 3.5, < 3.5.93.5.9composer require moodle/moodle:3.5.9 -
>= 3.6, < 3.6.73.6.7composer require moodle/moodle:3.6.7 -
>= 3.7, < 3.7.33.7.3composer require moodle/moodle:3.7.3
Tip — Not sure which release line you're on? Vulert can find the fix for the version you are using. Scan free →
Workaround
There is no known workaround for this vulnerability. It is essential to apply the official patches or upgrade to the fixed versions to eliminate the risk of exploitation.
Conclusion
The open redirect vulnerability in Moodle versions 3.7 to 3.7.3, 3.6 to 3.6.7, 3.5 to 3.5.9, and earlier poses a risk of redirecting users to malicious websites. It is recommended to upgrade to the fixed versions or apply the official patches to mitigate the vulnerability. For further support on vulnerability remediation, please contact DevNack.com.
See every vulnerability recorded for moodle/moodle →
FAQ
Moodle is an open-source learning management system used by educational institutions for online course management and delivery.
Moodle versions 3.7 to 3.7.3, 3.6 to 3.6.7, 3.5 to 3.5.9, and earlier are vulnerable to this open redirect vulnerability.
An open redirect vulnerability allows an attacker to craft a URL that redirects users to a different website, potentially leading to phishing attacks or the execution of malicious code.
To fix this vulnerability, you should upgrade your Moodle installation to version 3.5.9, 3.6.7, or 3.7.3, depending on the installed version.
No, there is no known workaround for this vulnerability. It is crucial to apply the official patches or upgrade to the fixed versions.
Related vulnerabilities
Recent vulnerabilities recorded for moodle/moodle.
Habilume
Habit tracker with a companion that grows with you
Complete habits, earn Lume Points, and watch your Lume grow as you stay consistent.
