VulnerabilityModified

CVE-2021-32478

The redirect URI in the LTI authorization endpoint required extra sanitizing to prevent reflected XSS and open redirect risks.

MEDIUM 6.1EPSS 1.13%

Does this matter?

Lower severity and a low EPSS score (1.13%). Track it; it rarely justifies an emergency change on its own.

Description

The redirect URI in the LTI authorization endpoint required extra sanitizing to prevent reflected XSS and open redirect risks. Moodle versions 3.10 to 3.10.3, 3.9 to 3.9.6, 3.8 to 3.8.8 and earlier unsupported versions are affected.

CVSS 3.1: 6.1 MEDIUMCVSS:3.1/AV:N/AC:L/PR:N/UI:R/S:C/C:L/I:L/A:N
EPSS: 1.13% probability · 65th percentile
CISA KEV: Not listed
Weakness: CWE-79, CWE-601
Affected: moodle/moodle
Source: secalert@redhat.com

References

https://moodle.org/mod/forum/discuss.php?d=422314Patch, Vendor Advisory
https://moodle.org/mod/forum/discuss.php?d=422314Patch, Vendor Advisory

Source: NVD record, EPSS from FIRST.org, KEV from CISA. Refreshed daily.