From 2c3895dd086b13da4670837927bc92f63f6e1e73 Mon Sep 17 00:00:00 2001
From: "advisory-database[bot]"
 <45398580+advisory-database[bot]@users.noreply.github.com>
Date: Wed, 12 Jul 2023 00:03:31 +0000
Subject: [PATCH] Publish Advisories

GHSA-78fm-qhh8-8858
GHSA-78fm-qhh8-8858
---
 .../GHSA-78fm-qhh8-8858.json                  | 108 ++++++++++++++++++
 .../GHSA-78fm-qhh8-8858.json                  |  38 ------
 2 files changed, 108 insertions(+), 38 deletions(-)
 create mode 100644 advisories/github-reviewed/2022/03/GHSA-78fm-qhh8-8858/GHSA-78fm-qhh8-8858.json
 delete mode 100644 advisories/unreviewed/2022/03/GHSA-78fm-qhh8-8858/GHSA-78fm-qhh8-8858.json

diff --git a/advisories/github-reviewed/2022/03/GHSA-78fm-qhh8-8858/GHSA-78fm-qhh8-8858.json b/advisories/github-reviewed/2022/03/GHSA-78fm-qhh8-8858/GHSA-78fm-qhh8-8858.json
new file mode 100644
index 00000000000..ae4a5204893
--- /dev/null
+++ b/advisories/github-reviewed/2022/03/GHSA-78fm-qhh8-8858/GHSA-78fm-qhh8-8858.json
@@ -0,0 +1,108 @@
+{
+  "schema_version": "1.4.0",
+  "id": "GHSA-78fm-qhh8-8858",
+  "modified": "2023-07-12T00:02:18Z",
+  "published": "2022-03-12T00:00:32Z",
+  "aliases": [
+    "CVE-2021-32478"
+  ],
+  "summary": "Moodle reflected XSS",
+  "details": "The redirect URI in the LTI authorization endpoint required extra sanitizing to prevent reflected XSS and open redirect risks. Moodle versions 3.10 to 3.10.3, 3.9 to 3.9.6, 3.8 to 3.8.8 and earlier unsupported versions are affected.",
+  "severity": [
+    {
+      "type": "CVSS_V3",
+      "score": "CVSS:3.1/AV:N/AC:L/PR:N/UI:R/S:C/C:L/I:L/A:N"
+    }
+  ],
+  "affected": [
+    {
+      "package": {
+        "ecosystem": "Packagist",
+        "name": "moodle/moodle"
+      },
+      "ranges": [
+        {
+          "type": "ECOSYSTEM",
+          "events": [
+            {
+              "introduced": "3.10"
+            },
+            {
+              "fixed": "3.10.4"
+            }
+          ]
+        }
+      ],
+      "database_specific": {
+        "last_known_affected_version_range": "<= 3.10.3"
+      }
+    },
+    {
+      "package": {
+        "ecosystem": "Packagist",
+        "name": "moodle/moodle"
+      },
+      "ranges": [
+        {
+          "type": "ECOSYSTEM",
+          "events": [
+            {
+              "introduced": "3.9"
+            },
+            {
+              "fixed": "3.9.7"
+            }
+          ]
+        }
+      ],
+      "database_specific": {
+        "last_known_affected_version_range": "<= 3.9.6"
+      }
+    },
+    {
+      "package": {
+        "ecosystem": "Packagist",
+        "name": "moodle/moodle"
+      },
+      "ranges": [
+        {
+          "type": "ECOSYSTEM",
+          "events": [
+            {
+              "introduced": "3.8"
+            },
+            {
+              "fixed": "3.8.9"
+            }
+          ]
+        }
+      ],
+      "database_specific": {
+        "last_known_affected_version_range": "<= 3.8.8"
+      }
+    }
+  ],
+  "references": [
+    {
+      "type": "ADVISORY",
+      "url": "https://nvd.nist.gov/vuln/detail/CVE-2021-32478"
+    },
+    {
+      "type": "WEB",
+      "url": "https://github.com/moodle/moodle/commit/752ad3d8eb4f9ac22dbf1461aa69d6e0baee503e"
+    },
+    {
+      "type": "WEB",
+      "url": "https://moodle.org/mod/forum/discuss.php?d=422314"
+    }
+  ],
+  "database_specific": {
+    "cwe_ids": [
+      "CWE-79"
+    ],
+    "severity": "MODERATE",
+    "github_reviewed": true,
+    "github_reviewed_at": "2023-07-12T00:02:18Z",
+    "nvd_published_at": "2022-03-11T18:15:00Z"
+  }
+}
\ No newline at end of file
diff --git a/advisories/unreviewed/2022/03/GHSA-78fm-qhh8-8858/GHSA-78fm-qhh8-8858.json b/advisories/unreviewed/2022/03/GHSA-78fm-qhh8-8858/GHSA-78fm-qhh8-8858.json
deleted file mode 100644
index e2eea0f04e5..00000000000
--- a/advisories/unreviewed/2022/03/GHSA-78fm-qhh8-8858/GHSA-78fm-qhh8-8858.json
+++ /dev/null
@@ -1,38 +0,0 @@
-{
-  "schema_version": "1.4.0",
-  "id": "GHSA-78fm-qhh8-8858",
-  "modified": "2022-03-19T00:01:18Z",
-  "published": "2022-03-12T00:00:32Z",
-  "aliases": [
-    "CVE-2021-32478"
-  ],
-  "details": "The redirect URI in the LTI authorization endpoint required extra sanitizing to prevent reflected XSS and open redirect risks. Moodle versions 3.10 to 3.10.3, 3.9 to 3.9.6, 3.8 to 3.8.8 and earlier unsupported versions are affected.",
-  "severity": [
-    {
-      "type": "CVSS_V3",
-      "score": "CVSS:3.1/AV:N/AC:L/PR:N/UI:R/S:C/C:L/I:L/A:N"
-    }
-  ],
-  "affected": [
-
-  ],
-  "references": [
-    {
-      "type": "ADVISORY",
-      "url": "https://nvd.nist.gov/vuln/detail/CVE-2021-32478"
-    },
-    {
-      "type": "WEB",
-      "url": "https://moodle.org/mod/forum/discuss.php?d=422314"
-    }
-  ],
-  "database_specific": {
-    "cwe_ids": [
-      "CWE-79"
-    ],
-    "severity": "MODERATE",
-    "github_reviewed": false,
-    "github_reviewed_at": null,
-    "nvd_published_at": "2022-03-11T18:15:00Z"
-  }
-}
\ No newline at end of file