PT-2019-11589 · Moodle+1 · Moodle+1

Lindon Wass · Published 2019-06-18 · Updated 2022-05-24 · CVE-2019-10133

Positive Technologies (AI Summary)

CVSS v3.1

6.1

Medium

Base vector

AV:N/AC:L/PR:N/UI:R/S:C/C:L/I:L/A:N

Name of the Vulnerable Software and Affected Versions: Moodle versions prior to 3.7 Moodle version 3.6.4 and earlier Moodle version 3.5.6 and earlier Moodle version 3.4.9 and earlier Moodle version 3.1.18 and earlier

Description: A flaw was found in the form to upload cohorts, which contained a redirect field that was not restricted to internal URLs.

Recommendations: For versions prior to 3.7, update to version 3.7 or later. For version 3.6.4 and earlier, update to version 3.6.5 or later. For version 3.5.6 and earlier, update to version 3.5.7 or later. For version 3.4.9 and earlier, update to version 3.4.10 or later. For version 3.1.18 and earlier, update to version 3.1.19 or later.

Fix

Open Redirect

Weakness Enumeration

CWE-601

Related Identifiers

ALT-PU-2019-2080

ALT-PU-2019-2096

CVE-2019-10133

GHSA-5XP2-RV4H-MM2Q

Affected Products

Alt Linux

Moodle

References · 14

• https://osv.dev/vulnerability/UBUNTU-CVE-2019-10133 · Vendor Advisory
• https://nvd.nist.gov/vuln/detail/CVE-2019-10133 · Security Note
• https://moodle.org/mod/forum/discuss.php?d=386523 · Vendor Advisory
• https://osv.dev/vulnerability/GHSA-5xp2-rv4h-mm2q · Vendor Advisory
• https://osv.dev/vulnerability/CVE-2019-10133 · Vendor Advisory
• https://ubuntu.com/security/CVE-2019-10133 · Vendor Advisory
• https://cve.org/CVERecord?id=CVE-2019-10133 · Security Note
• https://github.com/moodle/moodle · Note
• https://github.com/moodle/moodle/commit/c509d108216524887c7ca08b1c451054d669ea75 · Note
• https://github.com/moodle/moodle/commit/d5067bffd230d733ad24f6aeaa56aaa17eca5bfb · Note
• https://github.com/moodle/moodle/commit/cd6fb4322b6b1914c05f05033a71ed060f875fd4 · Note
• https://github.com/moodle/moodle/commit/5a89ac9640b3a695720845b6ddeff65e69a289fc · Note
• https://github.com/moodle/moodle/commit/a6258d0934f707b1d033f50fb41ffbcf45bb2102 · Note
• https://bugzilla.redhat.com/show_bug.cgi?id=CVE-2019-10133 · Note