vulnwire
6.1med

CVE-2019-14830

A vulnerability was found in Moodle 3.7 to 3.7.1, 3.6 to 3.6.5, 3.5 to 3.5.7 and earlier unsupported versions, where the mobile launch endp…

Published 5 y ago · modified 4 mo ago · JSON

CVSS
6.1
v3.1 · NVD
CISA KEV
No
not known exploited
EPSS
3.3%
percentile 89%
Public exploits
0
none known

A vulnerability was found in Moodle 3.7 to 3.7.1, 3.6 to 3.6.5, 3.5 to 3.5.7 and earlier unsupported versions, where the mobile launch endpoint contained an open redirect in some circumstances, which could result in a user's mobile access token being exposed. (Note: This does not affect sites with a forced URL scheme configured, mobile service disabled, or where the mobile app login method is "via the app").

Exploit prediction (EPSS)

3.30% probability of exploitation in the next 30 days, higher than 89% of all scored CVEs.

CVSS scores

Assigned byVersionScoreVector
NVD3.16.1CVSS:3.1/AV:N/AC:L/PR:N/UI:R/S:C/C:L/I:L/A:N
NVD2.05.8AV:N/AC:M/Au:N/C:P/I:P/A:N

Affected products

  • n/a Moodle

Classification

Weakness
  • CWE-601 URL Redirection to Untrusted Site

References

  • moodle.org /mod/forum/discuss.php?d=391036 · x_refsource_MISC, x_transferred
  • git.moodle.org /gw?p=moodle.git%3Ba=commit%3Bh=d4985a77391123c5959db432c076328f8d5e3624 · x_refsource_MISC, x_transferred

Sources

vulnwire keeps one entry per vulnerability: the CVE id wins, then GHSA; records that alias each other are merged. Machine-readable: JSON.