Moodle Open Redirect Vulnerability

Also known as GHSA-5xp2-rv4h-mm2q

Published 7 y ago 2019-06-26 · modified 4 mo ago 2026-06-17 · JSON

CVSS

3.1

v3.0 · CNA

CISA KEV

not known exploited

EPSS

0.9%

percentile 60%

Public exploits

none known

A flaw was found in Moodle before 3.7, 3.6.4, 3.5.6, 3.4.9 and 3.1.18. The form to upload cohorts contained a redirect field, which was not restricted to internal URLs.

Exploit prediction (EPSS)

0.90% probability of exploitation in the next 30 days, higher than 60% of all scored CVEs.

CVSS scores

Assigned by	Version	Score	Vector
CNA	3.0	3.1	`CVSS:3.0/AV:N/AC:H/PR:N/UI:R/S:U/C:N/I:L/A:N`
CNA	3.0	3.1	`CVSS:3.0/AV:N/AC:H/PR:N/UI:R/S:U/C:N/I:L/A:N`
NVD	3.0	6.1	`CVSS:3.0/AV:N/AC:L/PR:N/UI:R/S:C/C:L/I:L/A:N`
NVD	2.0	5.8	`AV:N/AC:M/Au:N/C:P/I:P/A:N`
GitHub	3.0	6.1	`CVSS:3.0/AV:N/AC:L/PR:N/UI:R/S:C/C:L/I:L/A:N`

Affected packages

Ecosystem	Package	Affected	Fixed in
packagist	`moodle/moodle`	>=3.6.0, <3.6.4 >=3.5.0, <3.5.6 >=3.4.0, <3.4.9 <3.1.18	3.6.4 3.5.6 3.4.9 3.1.18

Affected products

Moodle moodle

Classification

Weakness

CWE-601 URL Redirection to Untrusted Site

References

bugzilla.redhat.com /show_bug.cgi?id=CVE-2019-10133 · x_refsource_CONFIRM, x_transferred
moodle.org /mod/forum/discuss.php?d=386523 · x_refsource_CONFIRM, x_transferred
nvd.nist.gov /vuln/detail/CVE-2019-10133 · advisory
github.com /moodle/moodle/commit/5a89ac9640b3a695720845b6ddeff65e69a289fc · web
github.com /moodle/moodle/commit/a6258d0934f707b1d033f50fb41ffbcf45bb2102 · web
github.com /moodle/moodle/commit/c509d108216524887c7ca08b1c451054d669ea75 · web
github.com /moodle/moodle/commit/cd6fb4322b6b1914c05f05033a71ed060f875fd4 · web
github.com /moodle/moodle/commit/d5067bffd230d733ad24f6aeaa56aaa17eca5bfb · web
github.com /moodle/moodle · package

Sources

CVE List: CVE-2019-10133
GitHub Advisory: GHSA-5xp2-rv4h-mm2q
NVD: CVE-2019-10133

vulnwire keeps one entry per vulnerability: the CVE id wins, then GHSA; records that alias each other are merged. Machine-readable: JSON.

Summary