6.1

CVSS Score

3.0

-

CVSS Score

Basic Information

Concerned about an active attack path?

Talk to our security experts and see Miggo in action.

Miggo Vulnerability Database

→

CVE-2019-10133

CVE-2019-10133: Moodle Open Redirect Vulnerability

A flaw was found in Moodle before 3.7, 3.6.4, 3.5.6, 3.4.9 and 3.1.18. The form to upload cohorts contained a redirect field, which was not restricted to internal URLs.

(GitHub Advisory)

Miggo Vulnerability Database

→

CVE-2019-10133

CVE-2019-10133:

6.1

CVSS Score

3.0

-

CVSS Score

Basic Information

Is this CVE running in your environment?

Easily map the attack path and prioritize which CVEs are a threat to your organization

Validate Exposure

Technical Details

Package Name	Ecosystem	Vulnerable Versions	First Patched Version
moodle/moodle	composer	>= 3.6.0, <= 3.6.3	3.6.4
moodle/moodle	composer	>= 3.5.0, <= 3.5.5	3.5.6
moodle/moodle	composer	>= 3.4.0, <= 3.4.8	3.4.9
moodle/moodle	composer	<= 3.1.17	3.1.18

Technical Details

Vulnerability Intelligence
Miggo AI

Root Cause Analysis

The vulnerability arises from the handling of the 'returnurl' parameter. In the vulnerable versions, cohort/upload_form.php's cohort_upload_form::definition() function explicitly added a hidden 'returnurl' form field (with PARAM_URL type) that accepted user-controlled input. This parameter was then passed to cohort/upload.php, where it was used to construct a redirect URL without proper validation. The PARAM_URL type alone does not enforce internal URL restrictions, allowing external redirects. The patch removed this field entirely, confirming its role in the vulnerability. While upload.php's parameter retrieval (optional_param('returnurl')) was part of the chain, the root cause lies in the form's exposure of this unvalidated parameter.

Vulnerable functions

Only Mi**o us*rs **n s** t*is s**tion

Vulnerability Intelligence
Miggo AI

Unlock WAF rules for this CVE

Generate vendor-ready rules for the observed attack patterns, plus reasoning and safe deployment guidance

Get WAF rules

WAF Protection Rules

WAF Rule

W** rul*s *v*il**l* *or Mi**o *ustom*rs only.W** rul*s *v*il**l* *or Mi**o *ustom*rs only.W** rul*s *v*il**l* *or Mi**o *ustom*rs only.W** rul*s *v*il**l* *or Mi**o *ustom*rs only.W** rul*s *v*il**l* *or Mi**o *ustom*rs only.W** rul*s *v*il**l* *or Mi**o *ustom*rs only.W** rul*s *v*il**l* *or Mi**o *ustom*rs only.W** rul*s *v*il**l* *or Mi**o *ustom*rs only.W** rul*s *v*il**l* *or Mi**o *ustom*rs only.W** rul*s *v*il**l* *or Mi**o *ustom*rs only.

Reasoning

*v*il**l* *or Mi**o *ustom*rs only.*v*il**l* *or Mi**o *ustom*rs only.*v*il**l* *or Mi**o *ustom*rs only.*v*il**l* *or Mi**o *ustom*rs only.*v*il**l* *or Mi**o *ustom*rs only.*v*il**l* *or Mi**o *ustom*rs only.*v*il**l* *or Mi**o *ustom*rs only.*v*il**l* *or Mi**o *ustom*rs only.*v*il**l* *or Mi**o *ustom*rs only.*v*il**l* *or Mi**o *ustom*rs only.