Track vulnerabilities like this one. Sign up free to get alerted when software you use is affected.
6.1

Moodle: Malicious Redirects Can Steal User Data

CVE-2021-32478 · published 4 years ago
Summary

Moodle versions 3.10 to 3.10.3, 3.9 to 3.9.6, and 3.8 to 3.8.8 are at risk of allowing hackers to redirect users to fake websites and steal their login credentials. This is a security risk that needs to be addressed. To stay safe, update your Moodle installation to the latest version or apply a patch if available.

What to do
  • Update moodle moodle to version 3.10.4.
  • Update moodle moodle to version 3.9.7.
  • Update moodle moodle to version 3.8.9.
Affected software
Ecosystem VendorProductAffected versions
composer moodle moodle >= 3.10, <= 3.10.3
>= 3.9, <= 3.9.6
>= 3.8, <= 3.8.8
Fix: upgrade to 3.10.4
– moodle moodle < 3.8.9
>= 3.9.0, < 3.9.7
>= 3.10.0, < 3.10.4
cpe:2.3:a:moodle:moodle:*:*:*:*:*:*:*:*
Ubuntu:16.04:LTS canonical moodle All versions
Original advisory text
The redirect URI in the LTI authorization endpoint required extra sanitizing to prevent reflected XSS and open redirect risks. Moodle versions 3.10 to 3.10.3, 3.9 to 3.9.6, 3.8 to 3.8.8 and earlier...
The redirect URI in the LTI authorization endpoint required extra sanitizing to prevent reflected XSS and open redirect risks. Moodle versions 3.10 to 3.10.3, 3.9 to 3.9.6, 3.8 to 3.8.8 and earlier unsupported versions are affected.
References
Fix within
Internet-facing 60 days
Internal At next upgrade
  • Not known to be exploited
  • Needs hands-on effort to exploit (estimated)
  • Gives an attacker partial control (estimated)
Severity
6.1 Medium
Exploitation
1% chance of attack within 30 days
Type
CWE-79Cross-site Scripting (XSS)
CWE-601Open Redirect
Timeline
Published11 Mar 2022
Updated4 Nov 2026
First seen6 Mar 2026
Sources
GHSA-78fm-qhh8-8858 · GHSA
CVE-2021-32478 · NVD
UBUNTU-CVE-2021-32478 · OSV
CVE-2021-32478 · OSV
Track software like this
Free during beta