CVE-2019-10133

LOW

Moodle 3.1.0-3.1.17, 3.6.0-3.6.4 - Open Redirect via Cohort Upload Form

Title source: llm

Description

A flaw was found in Moodle before 3.7, 3.6.4, 3.5.6, 3.4.9 and 3.1.18. The form to upload cohorts contained a redirect field, which was not restricted to internal URLs.

References (2)

Core 2

Core References

Issue Tracking, Third Party Advisory x_refsource_confirm

https://bugzilla.redhat.com/show_bug.cgi?id=CVE-2019-10133

Patch, Vendor Advisory x_refsource_confirm

https://moodle.org/mod/forum/discuss.php?d=386523

Scores

CVSS v3 3.1

EPSS 0.0015

EPSS Percentile 35.6%

Attack Vector NETWORK

CVSS:3.0/AV:N/AC:H/PR:N/UI:R/S:U/C:N/I:L/A:N

Details

CWE

CWE-601

Status published

Products (2)

moodle/moodle 3.1.0 - 3.1.17

moodle/moodle 3.6.0 - 3.6.4Packagist

Published Jun 26, 2019

Tracked Since Feb 18, 2026