CVE-2015-3272
HighSummary
The clean_param function in lib/moodlelib.php in Moodle has an open redirect vulnerability that allows remote attackers to redirect users to arbitrary websites.
Risk Assessment
Attackers can exploit this vulnerability to conduct phishing attacks, potentially leading to user data theft and security breaches within the organization.
Recommendation
It is recommended to update Moodle to the latest version to mitigate this vulnerability and to monitor logs for potential attack attempts.
Other vulnerabilities in Moodle
See all- CVE-2016-7038High
In Moodle versions 2.x and 3.x, web service tokens are not invalidated when the user password is changed or forced to be changed.
- CVE-2015-5267High
In Moodle through version 2.6.11, 2.7.x before 2.7.10, 2.8.x before 2.8.8, and 2.9.x before 2.9.2, the random_string and complex_random_string functions rely on the PHP mt_rand function, making it easier for remote attackers to predict password-recovery tokens via a brute-force approach.
- CVE-2014-7845High
The generate_password function in Moodle through 2.4.11, and in versions 2.5.x before 2.5.9, 2.6.x before 2.6.6, and 2.7.x before 2.7.3 does not provide a sufficient number of possible temporary passwords, allowing remote attackers to gain access via a brute-force attack.
- CVE-2017-2641Critical
In Moodle versions 2.x and 3.x, SQL injection vulnerability can occur via user preferences.
- CVE-2024-37674Medium
A Cross Site Scripting (XSS) vulnerability in Moodle CMS v3.10 allows a remote attacker to execute arbitrary code via the Field Name (name parameter) of a new activity.
- CVE-2023-35133High
An issue in the logic used to check 0.0.0.0 against the cURL blocked hosts lists resulted in an SSRF risk. This flaw affects Moodle versions 4.2, 4.1 to 4.1.3, 4.0 to 4.0.8, 3.11 to 3.11.14, 3.9 to 3.9.21 and earlier unsupported versions.
- CVE-2023-35132Medium
A limited SQL injection risk was identified on the Mnet SSO access control page. This flaw affects Moodle versions 4.2, 4.1 to 4.1.3, 4.0 to 4.0.8, 3.11 to 3.11.14, 3.9 to 3.9.21 and earlier unsupported versions.
- CVE-2023-35131Medium
The groups page in Moodle has a vulnerability that requires additional content sanitization to prevent XSS risk. This issue affects Moodle versions 4.2, 4.1 to 4.1.3, 4.0 to 4.0.8, and 3.11 to 3.11.14.
- CVE-2020-1754Medium
In Moodle before versions 3.8.2, 3.7.5, 3.6.9, and 3.5.11, users viewing the grade history report without the 'access all groups' capability were not restricted to viewing grades of users within their own groups.
Original NVD description (English source)
Open redirect vulnerability in the clean_param function in lib/moodlelib.php in Moodle through 2.6.11, 2.7.x before 2.7.9, 2.8.x before 2.8.7, and 2.9.x before 2.9.1 allows remote attackers to redirect users to arbitrary web sites and conduct phishing attacks via vectors involving an HTTP Referer header that has a substring match with a local URL.