CVE-2021-32478

The redirect URI in the LTI authorization endpoint required extra sanitizing to prevent reflected XSS and open redirect risks. Moodle versions 3.10 to 3.10.3, 3.9 to 3.9.6, 3.8 to 3.8.8 and earlier unsupported versions are affected.

Affected

moodle

CVSS v3.1 NVD

6.1 MEDIUMCVSS:3.1/AV:N/AC:L/PR:N/UI:R/S:C/C:L/I:L/A:N

CVSS v2.0 NVD

4.3 MEDIUMAV:N/AC:M/Au:N/C:N/I:P/A:N

EPSS

1.13% chance of exploitation in the next 30 days, 66th percentile

Nuclei

medium · CWE-79

Published

2022-03-11

Updated

2024-08-03

Nuclei templates (1)

• projectdiscovery/nuclei-templates/blob/main/http/cves/2021/CVE-2021-32478.yaml

Security advisories

• https://moodle.org/mod/forum/discuss.php?d=422314
• advisories/GHSA-78fm-qhh8-8858

References

• CVE Record
• NVD entry