CVE-2014-9060
The LTI module in Moodle through 2.4.11, 2.5.x before 2.5.9, 2.6.x before 2.6.6, and 2.7.x before 2.7.3 does not properly restrict the parameters used in a return URL, which allows remote attackers to trigger the generation of arbitrary messages via a…
Does this matter?
Lower severity and a low EPSS score (2.12%). Track it; it rarely justifies an emergency change on its own.
Description
The LTI module in Moodle through 2.4.11, 2.5.x before 2.5.9, 2.6.x before 2.6.6, and 2.7.x before 2.7.3 does not properly restrict the parameters used in a return URL, which allows remote attackers to trigger the generation of arbitrary messages via a modified URL, related to mod/lti/locallib.php and mod/lti/return.php.
- CVSS 2.0
- 5.0 MEDIUMAV:N/AC:L/Au:N/C:P/I:N/A:N
- EPSS
- 2.12% probability · 81th percentile
- CISA KEV
- Not listed
- Weakness
- CWE-20
- Affected
- moodle/moodle
- Source
- cve@mitre.org
References
- http://git.moodle.org/gw?p=moodle.git&a=search&h=HEAD&st=commit&s=MDL-47927Vendor Advisory
- http://openwall.com/lists/oss-security/2014/11/17/11
- http://www.securitytracker.com/id/1031215
- https://moodle.org/mod/forum/discuss.php?d=275165
- http://git.moodle.org/gw?p=moodle.git&a=search&h=HEAD&st=commit&s=MDL-47927Vendor Advisory
- http://openwall.com/lists/oss-security/2014/11/17/11
- http://www.securitytracker.com/id/1031215
- https://moodle.org/mod/forum/discuss.php?d=275165
Source: NVD record, EPSS from FIRST.org, KEV from CISA. Refreshed daily.