CVE-2019-14831: 
NixOS vulnerability analysis and mitigation

A vulnerability was discovered in Moodle versions 3.7 to 3.7.1, 3.6 to 3.6.5, 3.5 to 3.5.7 and earlier unsupported versions, where the forum subscribe link contained an open redirect vulnerability when forced subscription mode was enabled. The vulnerability was assigned CVE-2019-14831 and was reported by John Couzins (Moodle Advisory).

The vulnerability occurs when a forum's subscription mode is set to "forced subscription", causing the forum's subscribe link to contain an open redirect. The severity was rated as MEDIUM with a CVSS v3.1 base score of 6.1 (Vector: CVSS:3.1/AV:N/AC:L/PR:N/UI:R/S:C/C:L/I:L/A:N). The vulnerability is classified as CWE-601: URL Redirection to Untrusted Site ('Open Redirect') (NVD).

The vulnerability could allow attackers to perform open redirect attacks when users interact with the forum subscribe link in forums configured with forced subscription mode (Moodle Advisory).

The vulnerability requires user interaction and is exploitable when the forum subscription mode is specifically set to "forced subscription" (NVD).

As a temporary workaround, administrators can set a different subscription mode (e.g., optional or auto) on forums until the patch is applied. The vulnerability has been fixed in Moodle versions 3.7.2, 3.6.6, and 3.5.8 (Moodle Advisory).