Uma falha foi encontrada no Moodle anterior a 3.7, 3.6.4, 3.5.6, 3.4.9 e 3.1.18. O formulário para carregar cohorts continha um campo de redirecionamento, que não era restrito a URLs internas.

An attacker could exploit this vulnerability by crafting a malicious cohort upload form that contains a redirect URL pointing to a phishing site or a site hosting malware. When a user attempts to upload the cohort, they would be redirected to the attacker-controlled site without their knowledge. This could lead to credential theft, malware infection, or other malicious activities. The impact is primarily related to user redirection and potential social engineering attacks, rather than direct system compromise. While the CVSS score is LOW, the potential for phishing and user deception should not be underestimated, especially in environments where users are not security-aware.

Educational institutions and organizations that rely on Moodle for course management and user authentication are at risk. Specifically, deployments using older, unsupported versions of Moodle (≤3.7, 3.6.4, 3.5.6, 3.4.9, and 3.1.18) are particularly vulnerable. Shared hosting environments running Moodle may also be at increased risk due to limited control over server configurations.

• php: Examine Moodle's cohort upload form code for the absence of URL validation on the redirect field. Search for instances where header('Location: ...') is used without proper sanitization. • generic web: Monitor web server access logs for unusual redirect patterns originating from the Moodle cohort upload form. Look for requests to unexpected external domains. • generic web: Use a WAF to monitor and block requests containing suspicious redirect URLs within the cohort upload form. Configure rules to prevent redirection to external domains.

1. 2019-06-26Disclosure

   disclosure

1. Reservado2019-03-27
2. Publicada2019-06-26
3. Modificada2024-08-04
4. EPSS atualizado2026-04-02

The primary mitigation for CVE-2019-10133 is to upgrade Moodle to version 3.7 or later, which includes the necessary fix. If upgrading immediately is not feasible, consider implementing a Web Application Firewall (WAF) rule to block redirects to external domains from the cohort upload form. Additionally, educate users about the risks of clicking on unexpected links and verifying the legitimacy of websites before entering credentials. Regularly review Moodle configuration settings to ensure that URL restrictions are properly enforced.