GHSA-r2wx-46gp-rp3h

Source

https://github.com/advisories/GHSA-r2wx-46gp-rp3h

Import Source

https://github.com/github/advisory-database/blob/main/advisories/github-reviewed/2024/05/GHSA-r2wx-46gp-rp3h/GHSA-r2wx-46gp-rp3h.json

JSON Data

https://api.test.osv.dev/v1/vulns/GHSA-r2wx-46gp-rp3h

Aliases

Published

2024-05-31T21:30:53Z

Modified

2025-05-31T06:41:50Z

Summary

Moodle Improper Input Validation

Details

Unsafe direct use of $_SERVER['HTTP_REFERER'] in admin/tool/mfa/index.php. The referrer URL used by MFA required additional sanitizing, rather than being used directly.

Database specific

{
    "cwe_ids":  [
        "CWE-20"
    ],
    "github_reviewed":  true,
    "github_reviewed_at":  "2024-06-04T15:52:11Z",
    "nvd_published_at":  "2024-05-31T20:15:09Z",
    "severity":  "HIGH"
}

References

Affected packages

Packagist / moodle/moodle

Package

Name: moodle/moodle
Purl: pkg:composer/moodle/moodle

Affected ranges

Type: ECOSYSTEM
Events: Introduced

4.3.0

Fixed

4.3.4

Affected versions

v4.*

v4.3.0

v4.3.1

v4.3.2

v4.3.3

Database specific

source

"https://github.com/github/advisory-database/blob/main/advisories/github-reviewed/2024/05/GHSA-r2wx-46gp-rp3h/GHSA-r2wx-46gp-rp3h.json"