CVE-2019-14830: Medium severity moodle vulnerability
A vulnerability was found in Moodle 3.7 to 3.7.1, 3.6 to 3.6.5, 3.5 to 3.5.7 and earlier unsupported versions, where the mobile launch endpoint contained an open redirect in some circumstances, which could result in a user's mobile access token being exposed. (Note: This does not affect sites with a forced URL scheme configured, mobile service disabled, or where the mobile app login method is "via the app").
Affected Software
Event History
Frequently Asked Questions
What is the severity of CVE-2019-14830?
CVE-2019-14830 has a medium severity level due to the potential exposure of mobile access tokens.
How do I fix CVE-2019-14830?
To fix CVE-2019-14830, update Moodle to version 3.7.2 or later, 3.6.6 or later, or 3.5.8 or later.
Which versions of Moodle are affected by CVE-2019-14830?
CVE-2019-14830 affects Moodle versions 3.5.0 to 3.5.7, 3.6.0 to 3.6.5, and 3.7.0 to 3.7.1.
What are the potential consequences of CVE-2019-14830?
The potential consequence of CVE-2019-14830 is the exposure of a user's mobile access token, leading to unauthorized access.
Is there a workaround for CVE-2019-14830?
There are no specific workarounds for CVE-2019-14830; upgrading to a patched version is recommended.