#VU43861 Input validation error in Moodle - CVE-2011-4294


| Updated: 2020-08-11

Vulnerability identifier: #VU43861

Vulnerability risk: Medium

CVSSv4.0: 2.7 [CVSS:4.0/AV:N/AC:L/AT:N/PR:N/UI:N/VC:N/VI:L/VA:L/SC:N/SI:N/SA:N/E:U/U:Green]

CVE-ID: CVE-2011-4294

CWE-ID: CWE-20

Exploitation vector: Network

Exploit availability: No

Vulnerable software:
Moodle
Web applications / Other software

Vendor: moodle.org

Description

The vulnerability allows a remote non-authenticated attacker to manipulate or delete data.

The error-message functionality in Moodle 1.9.x before 1.9.13, 2.0.x before 2.0.4, and 2.1.x before 2.1.1 does not ensure that a continuation link refers to an http or https URL for the local Moodle instance, which might allow attackers to trick users into visiting arbitrary web sites via unspecified vectors.

Mitigation
Install update from vendor's website.

Vulnerable software versions

Moodle: 1.9 - 1.9.12, 2.0 - 2.0.3, 2.1


External links
https://git.moodle.org/gw?p=moodle.git;a=commit;h=8f9f666c902cb30ef6f519353f38c45a29fdf4a6
https://moodle.org/mod/forum/discuss.php?d=182737
https://openwall.com/lists/oss-security/2011/11/14/1


Q & A

Can this vulnerability be exploited remotely?

Yes. This vulnerability can be exploited by a remote non-authenticated attacker via the Internet.

Is there known malware, which exploits this vulnerability?

No. We are not aware of malware exploiting this vulnerability.


Latest bulletins with this vulnerability