Description

course/jumpto.php in Moodle before 1.6.2 does not validate the session key (sesskey) before providing content from arbitrary local URIs, which allows remote attackers to obtain sensitive information via the jump parameter.

Remediation

References

CVE-2006-4943

Related Vulnerabilities

Moodle Improper Input Validation Vulnerability (CVE-2019-10134)

MyBB Improper Neutralization of Input During Web Page Generation ('Cross-site Scripting') Vulnerability (CVE-2022-43708)

WordPress Plugin Shield Security-Smart Bot Blocking & Intrusion Prevention Security Local File Inclusion (18.5.9)

WordPress Plugin Popup Maker-Popup for opt-ins, lead gen, & more Information Disclosure (1.8.11)

Oracle Database Server Other Vulnerability (CVE-2001-0943)

Severity

Medium

Tags

Missing Update Known Vulnerabilities CVE-2006-4943