Bug 1941742 (CVE-2019-14830)

Summary:	CVE-2019-14830 moodle: open redirect in the mobile launch endpoint could be used to expose mobile access tokens
Product:	[Other] Security Response	Reporter:	Guilherme de Almeida Suckevicz <gsuckevi>
Component:	vulnerability	Assignee:	Red Hat Product Security <security-response-team>
Status:	CLOSED NOTABUG	QA Contact:
Severity:	medium	Docs Contact:
Priority:	medium
Version:	unspecified	CC:	gwync, igor.raits
Target Milestone:	---	Keywords:	Security
Target Release:	---
Hardware:	All
OS:	Linux
Whiteboard:
Fixed In Version:		Doc Type:	If docs needed, set a value
Doc Text:	A vulnerability was found in Moodle where the mobile launch endpoint contained an open redirect in some circumstances, which could result in a user's mobile access token being exposed.	Story Points:	---
Clone Of:		Environment:
Last Closed:	2021-10-28 05:29:35 UTC	Type:	---
Regression:	---	Mount Type:	---
Documentation:	---	CRM:
Verified Versions:		Category:	---
oVirt Team:	---	RHEL 7.3 requirements from Atomic Host:
Cloudforms Team:	---	Target Upstream Version:
Embargoed:
Bug Depends On:	1941747
Bug Blocks:

Description Guilherme de Almeida Suckevicz 2021-03-22 16:46:36 UTC

A vulnerability was found in Moodle 3.7 to 3.7.1, 3.6 to 3.6.5, 3.5 to 3.5.7 and earlier unsupported versions, where the mobile launch endpoint contained an open redirect in some circumstances, which could result in a user's mobile access token being exposed. (Note: This does not affect sites with a forced URL scheme configured, mobile service disabled, or where the mobile app login method is "via the app").

Reference:
https://moodle.org/mod/forum/discuss.php?d=391036

Upstream patch:
https://git.moodle.org/gw?p=moodle.git;a=commit;h=d4985a77391123c5959db432c076328f8d5e3624

Comment 1 Guilherme de Almeida Suckevicz 2021-03-22 16:51:57 UTC

Created moodle tracking bugs for this issue:

Affects: epel-all [bug 1941747]