Candidate: CVE-2015-3272
PublicDate: 2016-02-22 05:59:00 UTC
References:
 https://cve.mitre.org/cgi-bin/cvename.cgi?name=CVE-2015-3272
 http://git.moodle.org/gw?p=moodle.git&a=search&h=HEAD&st=commit&s=MDL-50688
 http://www.openwall.com/lists/oss-security/2015/07/13/2
Description:
 Open redirect vulnerability in the clean_param function in
 lib/moodlelib.php in Moodle through 2.6.11, 2.7.x before 2.7.9, 2.8.x
 before 2.8.7, and 2.9.x before 2.9.1 allows remote attackers to redirect
 users to arbitrary web sites and conduct phishing attacks via vectors
 involving an HTTP Referer header that has a substring match with a local
 URL.
Ubuntu-Description:
Notes:
Bugs:
 http://bugs.debian.org/cgi-bin/bugreport.cgi?bug=792242
Priority: medium
Discovered-by:
Assigned-to:
CVSS:
 nvd: CVSS:3.0/AV:N/AC:L/PR:N/UI:R/S:C/C:N/I:H/A:N [7.4 HIGH]

Patches_moodle:
upstream_moodle: released (2.9.1, 2.8.7 and 2.7.9)
precise_moodle: ignored (reached end-of-life)
precise/esm_moodle: DNE (precise was needed)
trusty_moodle: ignored (reached end-of-life)
trusty/esm_moodle: DNE (trusty was needed)
utopic_moodle: ignored (reached end-of-life)
vivid_moodle: ignored (reached end-of-life)
vivid/stable-phone-overlay_moodle: DNE
vivid/ubuntu-core_moodle: DNE
wily_moodle: ignored (reached end-of-life)
xenial_moodle: not-affected (3.0.3+dfsg-0ubuntu1)
yakkety_moodle: ignored (reached end-of-life)
zesty_moodle: ignored (reached end-of-life)
artful_moodle: ignored (reached end-of-life)
bionic_moodle: not-affected (3.0.3+dfsg-0ubuntu1)
cosmic_moodle: not-affected (3.0.3+dfsg-0ubuntu1)
disco_moodle: not-affected (3.0.3+dfsg-0ubuntu1)
devel_moodle: not-affected (3.0.3+dfsg-0ubuntu1)