Vulnerabilities > Moodle > Medium

DATE CVE VULNERABILITY TITLE RISK
2022-03-11 CVE-2021-32477 Missing Authorization vulnerability in Moodle
The last time a user accessed the mobile app is displayed on their profile page, but should be restricted to users with the relevant capability (site administrators by default).
network
low complexity
moodle CWE-862
4.3
2022-03-11 CVE-2021-32478 Unspecified vulnerability in Moodle
The redirect URI in the LTI authorization endpoint required extra sanitizing to prevent reflected XSS and open redirect risks.
network
low complexity
moodle
6.1
2022-01-25 CVE-2022-0334 Exposure of Resource to Wrong Sphere vulnerability in Moodle
A flaw was found in Moodle in versions 3.11 to 3.11.4, 3.10 to 3.10.8, 3.9 to 3.9.11 and earlier unsupported versions.
network
low complexity
moodle CWE-668
4.3
2021-11-22 CVE-2021-43558 Cross-site Scripting vulnerability in multiple products
A flaw was found in Moodle in versions 3.11 to 3.11.3, 3.10 to 3.10.7, 3.9 to 3.9.10 and earlier unsupported versions.
network
low complexity
moodle fedoraproject CWE-79
6.1
2021-11-22 CVE-2021-43560 Exposure of Resource to Wrong Sphere vulnerability in multiple products
A flaw was found in Moodle in versions 3.11 to 3.11.3, 3.10 to 3.10.7, 3.9 to 3.9.10 and earlier unsupported versions.
network
low complexity
moodle fedoraproject CWE-668
5.3
2021-06-16 CVE-2021-32244 Cross-site Scripting vulnerability in Moodle 3.10.3
Cross Site Scripting (XSS) in Moodle 3.10.3 allows remote attackers to execute arbitrary web script or HTML via the "Description" field.
network
low complexity
moodle CWE-79
5.4
2021-05-17 CVE-2019-14827 Unspecified vulnerability in Moodle
A vulnerability was found in Moodle where javaScript injection was possible in some Mustache templates via recursive rendering from contexts.
network
low complexity
moodle
6.1
2021-03-19 CVE-2019-14831 Unspecified vulnerability in Moodle
A vulnerability was found in Moodle 3.7 to 3.7.1, 3.6 to 3.6.5, 3.5 to 3.5.7 and earlier unsupported versions, where forum subscribe link contained an open redirect if forced subscription mode was enabled.
network
low complexity
moodle
6.1
2021-03-19 CVE-2019-14830 Unspecified vulnerability in Moodle
A vulnerability was found in Moodle 3.7 to 3.7.1, 3.6 to 3.6.5, 3.5 to 3.5.7 and earlier unsupported versions, where the mobile launch endpoint contained an open redirect in some circumstances, which could result in a user's mobile access token being exposed.
network
low complexity
moodle
6.1
2021-03-19 CVE-2019-14829 Unspecified vulnerability in Moodle
A vulnerability was found in Moodle affection 3.7 to 3.7.1, 3.6 to 3.6.5, 3.5 to 3.5.7 and earlier unsupported versions where activity creation capabilities were not correctly respected when selecting the activity to use for a course in single activity mode.
network
low complexity
moodle
4.3