CVE-2011-4294
Moodle Open Redirect Via Error Messages
The error-message functionality in Moodle 1.9.x before 1.9.13, 2.0.x before 2.0.4, and 2.1.x before 2.1.1 does not ensure that a continuation link refers to an http or https URL for the local Moodle instance, which might allow attackers to trick users into visiting arbitrary web sites via unspecified vectors.
Exploit likelihood
What each source reports
NVD Score used
The error-message functionality in Moodle 1.9.x before 1.9.13, 2.0.x before 2.0.4, and 2.1.x before 2.1.1 does not ensure that a continuation link refers to an http or https URL for the local Moodle instance, which might allow attackers to trick users into visiting arbitrary web sites via unspecified vectors.
- Record
CVE-2011-4294- CVSS 2.0
- 5.8 Medium
AV:N/AC:M/Au:N/C:N/I:P/A:P - Weakness
- CWE-20
- Updated
- 2026-11-02
CVE List No score
The error-message functionality in Moodle 1.9.x before 1.9.13, 2.0.x before 2.0.4, and 2.1.x before 2.1.1 does not ensure that a continuation link refers to an http or https URL for the local Moodle instance, which might allow attackers to trick users into visiting arbitrary web sites via unspecified vectors.
- Record
CVE-2011-4294- Updated
- 2026-11-02
EUVDEUVD-2022-4243 No score
The error-message functionality in Moodle 1.9.x before 1.9.13, 2.0.x before 2.0.4, and 2.1.x before 2.1.1 does not ensure that a continuation link refers to an http or https URL for the local Moodle instance, which might allow attackers to trick users into visiting arbitrary web sites via unspecified vectors.
- Record
EUVD-2022-4243- Updated
- 2026-11-03
GitHub AdvisoriesGHSA-hxmp-8f47-x9fc No score
Moodle Open Redirect Via Error Messages
The error-message functionality in Moodle 1.9.x before 1.9.13, 2.0.x before 2.0.4, and 2.1.x before 2.1.1 does not ensure that a continuation link refers to an http or https URL for the local Moodle instance, which might allow attackers to trick users into visiting arbitrary web sites via error message links that lead offsite.
- Record
GHSA-hxmp-8f47-x9fc- Weakness
- CWE-601
- Updated
- 2026-11-02
OSVGHSA-hxmp-8f47-x9fc No score
Moodle Open Redirect Via Error Messages
The error-message functionality in Moodle 1.9.x before 1.9.13, 2.0.x before 2.0.4, and 2.1.x before 2.1.1 does not ensure that a continuation link refers to an http or https URL for the local Moodle instance, which might allow attackers to trick users into visiting arbitrary web sites via error message links that lead offsite.
- Record
GHSA-hxmp-8f47-x9fc- Weakness
- CWE-601
- Updated
- 2026-11-02
Affected products
Affected packages
| Package | Affected | Fixed |
|---|---|---|
moodle/moodlePackagist |
before 1.9.13 | 1.9.13 |
moodle/moodlePackagist |
2.0 up to 2.0.4 | 2.0.4 |
moodle/moodlePackagist |
2.1 up to 2.1.1 | 2.1.1 |
moodleDebian:6.0 From an advisory covering 5 CVEs |
before 1.9.9.dfsg2-2.1+squeeze2, plus listed versions 1.9.9.dfsg2-2.11.9.9.dfsg2-2.1+squeeze1 |
1.9.9.dfsg2-2.1+squeeze2 |
History
| Recorded | Changed | Sources |
|---|---|---|
| affected, facts | ||
| aliases | EUVD | |
| first indexed | CVE List, GitHub Advisories, NVD, OSV |
Dates are when Every CVE recorded each change. Upstream dates may differ.
In short
CVE-2011-4294 is a medium vulnerability (CVSS 5.8) in Moodle, published November 7, 2011. No source lists public exploit code. EPSS puts the chance of exploitation in the next 30 days at 1.54%, the 75th percentile. Fixed in moodle/moodle 1.9.13.
References
openwall.com/lists/oss-security/2011/11/14/1
git.moodle.org/gw?p=moodle.git%3Ba=commit%3Bh=8f9f666c902cb30ef6f519353f38c45a29fdf4a6
moodle.org/mod/forum/discuss.php?d=182737
nvd.nist.gov/vuln/detail/CVE-2011-4294
github.com/moodle/moodle/commit/18c2fcf8f19e00f0e89421d8fd8b7486a6dc6f79