Moodle through 2.6.11, 2.7.x before 2.7.13, 2.8.x before 2.8.11, 2.9.x before 2.9.5, and 3.0.x before 3.0.3 does not properly restrict links, which allows remote attackers to obtain sensitive URL information by reading a Referer log.
| Date Added | Due Date | Vulnerability Name | Required Action |
|---|---|---|---|
| N/A |
| Type | Version | Base score | Base severity | Vector |
|---|---|---|---|---|
| Primary | 3.0 | 5.3 | MEDIUM | CVSS:3.0/AV:N/AC:L/PR:N/UI:N/S:U/C:L/I:N/A:N |
| Primary | 2.0 | 5.0 | MEDIUM | AV:N/AC:L/Au:N/C:P/I:N/A:N |
| Hyperlink | Source | Resource |
|---|---|---|
| http://git.moodle.org/gw?p=moodle.git&a=search&h=HEAD&st=commit&s=MDL-52651 | secalert@redhat.com | N/A |
| http://www.openwall.com/lists/oss-security/2016/03/21/1 | secalert@redhat.com | N/A |
| http://www.securitytracker.com/id/1035333 | secalert@redhat.com | N/A |
| https://moodle.org/mod/forum/discuss.php?d=330181 | secalert@redhat.com | Vendor Advisory |
| http://git.moodle.org/gw?p=moodle.git&a=search&h=HEAD&st=commit&s=MDL-52651 | af854a3a-2127-422b-91ae-364da2661108 | N/A |
| http://www.openwall.com/lists/oss-security/2016/03/21/1 | af854a3a-2127-422b-91ae-364da2661108 | N/A |
| http://www.securitytracker.com/id/1035333 | af854a3a-2127-422b-91ae-364da2661108 | N/A |
| https://moodle.org/mod/forum/discuss.php?d=330181 | af854a3a-2127-422b-91ae-364da2661108 | Vendor Advisory |