CVE-2019-14831: Medium severity moodle vulnerability

Q: What is the severity of CVE-2019-14831?

CVE-2019-14831 is rated as a moderate severity vulnerability.

Q: How do I fix CVE-2019-14831?

To fix CVE-2019-14831, upgrade to Moodle versions 3.7.2, 3.6.6, or 3.5.8 or later.

Q: What systems are affected by CVE-2019-14831?

CVE-2019-14831 affects Moodle versions 3.7 to 3.7.1, 3.6 to 3.6.5, and 3.5 to 3.5.7.

Q: What type of attack does CVE-2019-14831 facilitate?

CVE-2019-14831 allows for an open redirect attack when forced subscription mode is enabled in forums.

Q: What is the risk of not addressing CVE-2019-14831?

Failing to address CVE-2019-14831 may expose users to phishing attacks through the open redirect feature.

Published Mar 19, 2021

Updated

A vulnerability was found in Moodle 3.7 to 3.7.1, 3.6 to 3.6.5, 3.5 to 3.5.7 and earlier unsupported versions, where forum subscribe link contained an open redirect if forced subscription mode was enabled. If a forum's subscription mode was set to "forced subscription", the forum's subscribe link contained an open redirect.

Affected Software

3 affected components

Moodle moodle>=3.5.0<=3.5.7

Moodle moodle>=3.6.0<=3.6.5

Moodle moodle>=3.7.0<=3.7.1

Event History

Mar 19, 2021

CVE Published

via MITRE·08:19 PM

Data Sourced

via MITRE·08:19 PM

DescriptionWeakness

Frequently Asked Questions

What is the severity of CVE-2019-14831?

CVE-2019-14831 is rated as a moderate severity vulnerability.

How do I fix CVE-2019-14831?

To fix CVE-2019-14831, upgrade to Moodle versions 3.7.2, 3.6.6, or 3.5.8 or later.

What systems are affected by CVE-2019-14831?