VULNERABILITY INTELLIGENCE

CVE-2021-32478

CVSS score6.1 MEDIUM
EPSS probability1.13%
CISA KEVNot currently listed
Published2022-03-11
Last modified2026-06-17
CVSS vectorCVSS:3.1/AV:N/AC:L/PR:N/UI:R/S:C/C:L/I:L/A:N

Description

The redirect URI in the LTI authorization endpoint required extra sanitizing to prevent reflected XSS and open redirect risks. Moodle versions 3.10 to 3.10.3, 3.9 to 3.9.6, 3.8 to 3.8.8 and earlier unsupported versions are affected.

Weakness classification

  • secalert@redhat.com: CWE-79
  • nvd@nist.gov: CWE-79

Primary references