Moodle Improper Neutralization of Input During Web Page Generation ('Cross-site Scripting') Vulnerability (CVE-2021-32478)

Description

The redirect URI in the LTI authorization endpoint required extra sanitizing to prevent reflected XSS and open redirect risks. Moodle versions 3.10 to 3.10.3, 3.9 to 3.9.6, 3.8 to 3.8.8 and earlier unsupported versions are affected.

Remediation

References

CVE-2021-32478

Related Vulnerabilities

MySQL CVE-2017-10365 Vulnerability (CVE-2017-10365)

WordPress Plugin Elementor Website Builder Unspecified Vulnerability (1.8.8)

WordPress Plugin Blog Designer Cross-Site Scripting (1.8.11)

WordPress 5.0 Multiple Vulnerabilities (5.0)

Joomla Improper Neutralization of Input During Web Page Generation ('Cross-site Scripting') Vulnerability (CVE-2021-23129)

Severity

Medium

Classification

CVE-2021-32478 CWE-707 CVSS:3.1/AV:N/AC:L/PR:N/UI:R/S:C/C:L/I:L/A:N