CVE-2024-33999: moodle: unsafe direct use of $_SERVER['HTTP_REFERER'] in admin/tool/mfa/index.php

What the vulnerability does

01Description

The referrer URL used by MFA required additional sanitizing, rather than being used directly.

Key dates

02Disclosure timeline

May 31, 2024 CVE published

August 29, 2024 Record updated

External resources

03References

NVD — National Vulnerability Database https://nvd.nist.gov/vuln/detail/CVE-2024-33999 CWE — Common Weakness Enumeration https://cwe.mitre.org/data/definitions/20.html