Improper input validation in Moodle

CVE-2012-6101

Multiple open redirect vulnerabilities in Moodle 2.2.x before 2.2.7, 2.3.x before 2.3.4, and 2.4.x before 2.4.1 allow remote attackers to redirect users to arbitrary web sites and conduct phishing attacks via vectors related to (1) backup/backupfilesedit.php, (2) comment/comment_post.php, (3) course/switchrole.php, (4) mod/wiki/filesedit.php, (5) tag/coursetags_add.php, or (6) user/files.php.

Vulnerability class: Drupalgeddon 2 (CVE-2018-7600)

EPSS: 0.012 (65.2th percentile) — read the EPSS interpretation.

Affected products

  • Moodle — versions 2.2.0, 2.2.1, 2.2.2
  • N/a — versions n/a

Weakness classification (CWE)

References