CVE-2019-14831

MediumCVSS 6.1/10Last modified Jun 17, 2026

Description

A vulnerability was found in Moodle 3.7 to 3.7.1, 3.6 to 3.6.5, 3.5 to 3.5.7 and earlier unsupported versions, where forum subscribe link contained an open redirect if forced subscription mode was enabled. If a forum's subscription mode was set to "forced subscription", the forum's subscribe link contained an open redirect.

Metrics

CVSS 3.1 6.1/10CVSS:3.1/AV:N/AC:L/PR:N/UI:R/S:C/C:L/I:L/A:N

Weakness enumeration

CWE-601

Affected software

Vendor	Product	Versions
n/a	Moodle	3.7 to 3.7.1, 3.6 to 3.6.5, 3.5 to 3.5.7 and earlier unsupported versions

References

https://git.moodle.org/gw?p=moodle.git%3Ba=commit%3Bh=32e2e06a8737afb07ee83abb3eacd39f8b181216
https://moodle.org/mod/forum/discuss.php?d=391037Release Notes, Vendor Advisory
https://git.moodle.org/gw?p=moodle.git%3Ba=commit%3Bh=32e2e06a8737afb07ee83abb3eacd39f8b181216
https://moodle.org/mod/forum/discuss.php?d=391037Release Notes, Vendor Advisory

Timeline

Published: Mar 19, 2021
Last modified: Jun 17, 2026
NVD status: Modified

Related CVEs from 2019

CVE-2019-148327.5A flaw was found in the Keycloak REST API before version 8.0.0 where it would permit user access from a realm the user was not configured. A CVE-2019-148335.4A flaw was found in Samba, all versions starting samba 4.5.0 before samba 4.9.15, samba 4.10.10, samba 4.11.2, in the way it handles a user CVE-2019-148343.7A vulnerability was found in dnsmasq before version 2.81, where the memory leak allows remote attackers to cause a denial of service (memory CVE-2019-148357.8A buffer overflow flaw was found, in versions from 2.6.34 to 5.2.x, in the way Linux kernel's vhost functionality that translates virtqueue CVE-2019-148368.8A vulnerability was found that the 3scale dev portal does not employ mechanisms for protection against login CSRF. An attacker could use thi CVE-2019-148379.1A flaw was found in keycloack before version 8.0.0. The owner of 'placeholder.org' domain can setup mail server on this domain and knowing o CVE-2019-148384.9A flaw was found in wildfly-core before 7.2.5.GA. The Management users with Monitor, Auditor and Deployer Roles should not be allowed to mod CVE-2019-148397.5It was observed that while login into Business-central console, HTTP request discloses sensitive information like username and password when CVE-2019-14847.8A remote code execution vulnerability exists when Microsoft Windows OLE fails to properly validate user input, aka 'Windows OLE Remote Code CVE-2019-148407.5A flaw was found in the RHDM, where sensitive HTML form fields like Password has auto-complete enabled which may lead to leak of credentials CVE-2019-148418.8A flaw was found in the RHDM, where an authenticated attacker can change their assigned role in the response header. This flaw allows an att CVE-2019-148429.8Structured reply is a feature of the newstyle NBD protocol allowing the server to send a reply in chunks. A bounds check which was supposed