Moodle - XSS (CVE-2021-32478)

CVE-2021-32478 is a vulnerability in Moodle's LTI authorization endpoint that exposes users to reflected cross-site scripting (XSS) and open redirect attacks due to insufficient sanitization of the redirect URI. Attackers could exploit this flaw to execute malicious scripts or redirect users to malicious sites, potentially leading to credential theft or phishing.

CrowdSec has been tracking this vulnerability and its exploits since 29th of October 2025.

According to CrowdSec data, while opportunistic exploitation dominates, a portion of threat actors trying to exploit CVE-2021-32478 apply basic targeting methods such as port or service detection. This indicates emerging patterns of selective targeting. In addition, according to the CrowdSec network, attack volume against CVE-2021-32478 has dipped slightly compared to the previous week. Although still commonly targeted, the decline suggests a cooling-off period. Long-term relevance remains, but attention is waning.

Attackers exploit the /mod/lti/auth.php endpoint by supplying a malicious redirect_uri parameter, enabling reflected XSS or open redirect attacks through crafted URLs.