CVE-2019-10133

MediumCVSS 6.1/10Last modified Jun 17, 2026

Description

A flaw was found in Moodle before 3.7, 3.6.4, 3.5.6, 3.4.9 and 3.1.18. The form to upload cohorts contained a redirect field, which was not restricted to internal URLs.

Metrics

CVSS 3.0 6.1/10CVSS:3.0/AV:N/AC:L/PR:N/UI:R/S:C/C:L/I:L/A:N

Weakness enumeration

CWE-601

Affected software

Vendor	Product	Versions
Moodle	moodle	3.7, 3.6.4, 3.5.6, 3.4.9 and 3.1.18

References

https://bugzilla.redhat.com/show_bug.cgi?id=CVE-2019-10133Issue Tracking, Third Party Advisory
https://moodle.org/mod/forum/discuss.php?d=386523Patch, Vendor Advisory
https://bugzilla.redhat.com/show_bug.cgi?id=CVE-2019-10133Issue Tracking, Third Party Advisory
https://moodle.org/mod/forum/discuss.php?d=386523Patch, Vendor Advisory

Timeline

Published: Jun 26, 2019
Last modified: Jun 17, 2026
NVD status: Modified

Related CVEs from 2019

CVE-2019-101343.7A flaw was found in Moodle before 3.7, 3.6.4, 3.5.6, 3.4.9 and 3.1.18. The size of users' private file uploads via email were not correctly CVE-2019-101357.2A flaw was found in the yaml.load() function in the osbs-client versions since 0.46 before 0.56.1. Insecure use of the yaml.load() function CVE-2019-101364.3It was found that Spacewalk, all versions through 2.9, did not safely compute client token checksums. An attacker with a valid, but expired,CVE-2019-101379.8A path traversal flaw was found in spacewalk-proxy, all versions through 2.9, in the way the proxy processes cached client tokens. A remote,CVE-2019-101388.8A flaw was discovered in the python-novajoin plugin, all versions up to, excluding 1.1.1, for Red Hat OpenStack Platform. The novajoin API l CVE-2019-101397.8During HE deployment via cockpit-ovirt, cockpit-ovirt generates an ansible variable file `/var/lib/ovirt-hosted-engine-setup/cockpit/ansible CVE-2019-10147.0An elevation of privilege vulnerability exists in Windows when the Win32k component fails to properly handle objects in memory. An attacker CVE-2019-101405.5A vulnerability was found in Linux kernel's, versions up to 3.10, implementation of overlayfs. An attacker with local access can create a de CVE-2019-101419.1A vulnerability was found in openstack-ironic-inspector all versions excluding 5.0.2, 6.0.3, 7.2.4, 8.0.3 and 8.2.1. A SQL-injection vulnera CVE-2019-101427.8A flaw was found in the Linux kernel's freescale hypervisor manager implementation, kernel versions 5.0.x up to, excluding 5.0.17. A paramet CVE-2019-101437.0It was discovered freeradius up to and including version 3.0.19 does not correctly configure logrotate, allowing a local attacker who alread CVE-2019-101447.7rkt through version 1.30.0 does not isolate processes in containers that are run with `rkt enter`. Processes run with `rkt enter` are given