CVE-2021-32478

MediumCVSS 6.1/10Last modified Jun 17, 2026

Description

The redirect URI in the LTI authorization endpoint required extra sanitizing to prevent reflected XSS and open redirect risks. Moodle versions 3.10 to 3.10.3, 3.9 to 3.9.6, 3.8 to 3.8.8 and earlier unsupported versions are affected.

Metrics

CVSS 3.1 6.1/10CVSS:3.1/AV:N/AC:L/PR:N/UI:R/S:C/C:L/I:L/A:N

Weakness enumeration

CWE-79 CWE-601

Affected software

No affected versions have been published.

Timeline

Published: Mar 11, 2022
Last modified: Jun 17, 2026
NVD status: Modified

Related CVEs from 2021

CVE-2021-324816.1Cloudera Hue 4.6.0 allows XSS via the type parameter.CVE-2021-324826.1Cloudera Manager 5.x, 6.x, 7.1.x, 7.2.x, and 7.3.x allows XSS via the path parameter.CVE-2021-324835.3Cloudera Manager 7.2.4 has Incorrect Access Control, allowing Escalation of Privileges to view the restricted Dashboard.CVE-2021-324847.5In modem 2G RRM, there is a possible system crash due to a heap buffer overflow. This could lead to remote denial of service with no additio CVE-2021-324857.5In modem 2G RRM, there is a possible system crash due to a heap buffer overflow. This could lead to remote denial of service with no additio CVE-2021-324867.5In modem 2G RRM, there is a possible system crash due to a heap buffer overflow. This could lead to remote denial of service with no additio CVE-2021-324877.5In modem 2G RRM, there is a possible system crash due to a heap buffer overflow. This could lead to remote denial of service with no additio CVE-2021-324894.4An issue was discovered in the _send_secure_msg() function of Yubico yubihsm-shell through 2.0.3. The function does not correctly validate t CVE-2021-324907.8A flaw was found in djvulibre-3.5.28 and earlier. An out of bounds write in function DJVU::filter_bv() via crafted djvu file may lead to app CVE-2021-324917.8A flaw was found in djvulibre-3.5.28 and earlier. An integer overflow in function render() in tools/ddjvu via crafted djvu file may lead to CVE-2021-324927.8A flaw was found in djvulibre-3.5.28 and earlier. An out of bounds read in function DJVU::DataPool::has_data() via crafted djvu file may lea CVE-2021-324937.8A flaw was found in djvulibre-3.5.28 and earlier. A heap buffer overflow in function DJVU::GBitmap::decode() via crafted djvu file may lead