CVE-2019-14830

MediumCVSS 6.1/10Last modified Jun 17, 2026

Description

A vulnerability was found in Moodle 3.7 to 3.7.1, 3.6 to 3.6.5, 3.5 to 3.5.7 and earlier unsupported versions, where the mobile launch endpoint contained an open redirect in some circumstances, which could result in a user's mobile access token being exposed. (Note: This does not affect sites with a forced URL scheme configured, mobile service disabled, or where the mobile app login method is "via the app").

Metrics

CVSS 3.1 6.1/10CVSS:3.1/AV:N/AC:L/PR:N/UI:R/S:C/C:L/I:L/A:N

Weakness enumeration

CWE-601

Affected software

No affected versions have been published.

Timeline

Published: Mar 19, 2021
Last modified: Jun 17, 2026
NVD status: Modified

Related CVEs from 2019

CVE-2019-148316.1A vulnerability was found in Moodle 3.7 to 3.7.1, 3.6 to 3.6.5, 3.5 to 3.5.7 and earlier unsupported versions, where forum subscribe link co CVE-2019-148327.5A flaw was found in the Keycloak REST API before version 8.0.0 where it would permit user access from a realm the user was not configured. A CVE-2019-148335.4A flaw was found in Samba, all versions starting samba 4.5.0 before samba 4.9.15, samba 4.10.10, samba 4.11.2, in the way it handles a user CVE-2019-148343.7A vulnerability was found in dnsmasq before version 2.81, where the memory leak allows remote attackers to cause a denial of service (memory CVE-2019-148357.8A buffer overflow flaw was found, in versions from 2.6.34 to 5.2.x, in the way Linux kernel's vhost functionality that translates virtqueue CVE-2019-148368.8A vulnerability was found that the 3scale dev portal does not employ mechanisms for protection against login CSRF. An attacker could use thi CVE-2019-148379.1A flaw was found in keycloack before version 8.0.0. The owner of 'placeholder.org' domain can setup mail server on this domain and knowing o CVE-2019-148384.9A flaw was found in wildfly-core before 7.2.5.GA. The Management users with Monitor, Auditor and Deployer Roles should not be allowed to mod CVE-2019-148397.5It was observed that while login into Business-central console, HTTP request discloses sensitive information like username and password when CVE-2019-14847.8A remote code execution vulnerability exists when Microsoft Windows OLE fails to properly validate user input, aka 'Windows OLE Remote Code CVE-2019-148407.5A flaw was found in the RHDM, where sensitive HTML form fields like Password has auto-complete enabled which may lead to leak of credentials CVE-2019-148418.8A flaw was found in the RHDM, where an authenticated attacker can change their assigned role in the response header. This flaw allows an att