Staging Environment: Content and features may be unstable or change without notice.
Advisory details: github_osv / GHSA-hxmp-8f47-x9fc
Advisory ID github_osv/GHSA-hxmp-8f47-x9fc
Aliases CVE-2011-4294
Summary Moodle Open Redirect Via Error Messages The error-message functionality in Moodle 1.9.x before 1.9.13, 2.0.x before 2.0.4, and 2.1.x before 2.1.1 does not ensure that a continuation link refers to an http or https URL for the local Moodle instance, which might allow attackers to trick users into visiting arbitrary web sites via error message links that lead offsite.
Status Published
Exploitability 0.5
Weighted Severity 0.0
Risk
Affected and Fixed Packages Package Details
Introduced and Fixed Package Commit Patches Package Commit Patches Details
Weaknesses (1)
CWE-601 URL Redirection to Untrusted Site ('Open Redirect')
System Score Found at
generic_textual MODERATE
Reference id Reference type URL
http://git.moodle.org/gw?p=moodle.git;a=commit;h=8f9f666c902cb30ef6f519353f38c45a29fdf4a6
http://moodle.org/mod/forum/discuss.php?d=182737
http://openwall.com/lists/oss-security/2011/11/14/1
https://github.com/moodle/moodle
https://github.com/moodle/moodle/commit/18c2fcf8f19e00f0e89421d8fd8b7486a6dc6f79
https://github.com/moodle/moodle/commit/417fdfab6bbdcfc3f5b64704ec06912ae9cd1050
https://github.com/moodle/moodle/commit/8f9f666c902cb30ef6f519353f38c45a29fdf4a6
CVE-2011-4294 https://nvd.nist.gov/vuln/detail/CVE-2011-4294
No exploits are available.

No EPSS data available for this advisory.

Patch URL
There are no known patches.
There are no known vectors.

There are no SSVC decisions available.