Description

course/jumpto.php in Moodle before 1.6.2 does not validate the session key (sesskey) before providing content from arbitrary local URIs, which allows remote attackers to obtain sensitive information via the jump parameter.

Remediation

References

CVE-2006-4943

Related Vulnerabilities

XWiki Improper Neutralization of Input During Web Page Generation ('Cross-site Scripting') Vulnerability (CVE-2021-3137)

Drupal Core 8.x.x Multiple Cross-Site Scripting Vulnerabilities (8.0.0 - 8.7.14)

WordPress Plugin MobileChief-Mobile Site Builder Cross-Site Scripting (1.5.7)

WordPress Plugin WordPress Survey & Poll-Quiz, Survey and Poll SQL Injection (1.1.91)

Jboss EAP CVE-2016-5018 Vulnerability (CVE-2016-5018)

Severity

Medium

Classification

CVE-2006-4943

Tags

Missing Update Known Vulnerabilities