Moodle におけるオープンリダイレクトの脆弱性
| Title |
Moodle におけるオープンリダイレクトの脆弱性
|
| Summary |
Moodle には、オープンリダイレクトの脆弱性が存在します。
|
| Possible impacts |
情報を取得される、および情報を改ざんされる可能性があります。 |
| Solution |
ベンダより正式な対策が公開されています。ベンダ情報を参照して適切な対策を実施してください。 |
| Publication Date |
Sept. 3, 2019, midnight |
| Registration Date |
Nov. 24, 2021, 3:47 p.m. |
| Last Update |
Nov. 24, 2021, 3:47 p.m. |
|
CVSS3.0 : 警告
|
| Score |
6.1
|
| Vector |
CVSS:3.0/AV:N/AC:L/PR:N/UI:R/S:C/C:L/I:L/A:N |
|
CVSS2.0 : 警告
|
| Score |
5.8
|
| Vector |
AV:N/AC:M/Au:N/C:P/I:P/A:N |
Affected System
CVE (情報セキュリティ 共通脆弱性識別子)
CWE (共通脆弱性タイプ一覧)
ベンダー情報
Change Log
| No |
Changed Details |
Date of change |
| 1 |
[2021年11月24日]
掲載 |
Nov. 24, 2021, 3:47 p.m. |
NVD Vulnerability Information
CVE-2019-14830
| Summary |
A vulnerability was found in Moodle 3.7 to 3.7.1, 3.6 to 3.6.5, 3.5 to 3.5.7 and earlier unsupported versions, where the mobile launch endpoint contained an open redirect in some circumstances, which could result in a user's mobile access token being exposed. (Note: This does not affect sites with a forced URL scheme configured, mobile service disabled, or where the mobile app login method is "via the app").
|
| Publication Date |
March 20, 2021, 6:15 a.m. |
| Registration Date |
March 20, 2021, 10 a.m. |
| Last Update |
Nov. 21, 2024, 1:27 p.m. |
Affected software configurations
| Configuration1 |
or higher |
or less |
more than |
less than |
| cpe:2.3:a:moodle:moodle:*:*:*:*:*:*:*:* |
3.5.0 |
3.5.7 |
|
|
| cpe:2.3:a:moodle:moodle:*:*:*:*:*:*:*:* |
3.6.0 |
3.6.5 |
|
|
| cpe:2.3:a:moodle:moodle:*:*:*:*:*:*:*:* |
3.7.0 |
3.7.1 |
|
|
Related information, measures and tools
Common Vulnerabilities List