Description

The redirect URI in the LTI authorization endpoint required extra sanitizing to prevent reflected XSS and open redirect risks. Moodle versions 3.10 to 3.10.3, 3.9 to 3.9.6, 3.8 to 3.8.8 and earlier unsupported versions are affected.

Remediation

References

CVE-2021-32478

Related Vulnerabilities

Oracle Database Server Other Vulnerability (CVE-2005-0298)

MySQL CVE-2022-21378 Vulnerability (CVE-2022-21378)

osTicket Improper Neutralization of Input During Web Page Generation ('Cross-site Scripting') Vulnerability (CVE-2020-14012)

WordPress Plugin WP Image Zoom Local File Inclusion (1.46)

WordPress Plugin Social Media Widget by Acurax Cross-Site Scripting (2.2)

Severity

Medium

Classification

CVE-2021-32478 CWE-707 CVSS:3.1/AV:N/AC:L/PR:N/UI:R/S:C/C:L/I:L/A:N

Tags

Missing Update Known Vulnerabilities