Description
A vulnerability was found in Moodle which exists due to insufficient validation of the HTTP request origin in course redirect URL. A user's CSRF token was unnecessarily included in the URL when being redirected to a course they have just restored. A remote attacker can trick the victim to visit a specially crafted web page and perform arbitrary actions on behalf of the victim on the vulnerable website. This flaw allows an attacker to perform cross-site request forgery attacks.
Remediation
References
Related Vulnerabilities
Moodle Uncontrolled Resource Consumption Vulnerability (CVE-2021-32476)
Jboss EAP Exposure of Sensitive Information to an Unauthorized Actor Vulnerability (CVE-2017-9788)
MySQL CVE-2019-2914 Vulnerability (CVE-2019-2914)
MySQL CVE-2012-3197 Vulnerability (CVE-2012-3197)
Oracle Application Server Other Vulnerability (CVE-2002-0569)