Moodle - XSS (CVE-2021-32478)

CVE-2021-32478 is a vulnerability in Moodle's LTI authorization endpoint that exposes users to reflected cross-site scripting (XSS) and open redirect attacks due to insufficient sanitization of the redirect URI. Attackers could exploit this flaw to execute malicious scripts or redirect users to malicious sites, potentially leading to credential theft or phishing.

CrowdSec has been tracking this vulnerability and its exploits since 29th of October 2025.

CrowdSec network observations suggest that most exploitation of CVE-2021-32478 involves focused reconnaissance to identify viable targets. Attackers typically tailor their campaigns based on system exposure and configuration. It is unlikely that a given attack is accidental. Telemetry from the CrowdSec network also shows that exploitation activity for CVE-2021-32478 remains steady week-over-week. Attack volumes are consistent with long-term trends, indicating sustained interest from threat actors. CVE-2021-32478 continues to be an active part of the threat landscape and will likely remain this way for the forseeable future.

Attackers exploit the /mod/lti/auth.php endpoint by supplying a malicious redirect_uri parameter, enabling reflected XSS or open redirect attacks through crafted URLs.