The form to upload cohorts contained a redirect field, which was not restricted to internal URLs.
|Versions affected:||3.6 to 3.6.3, 3.5 to 3.5.5, 3.4 to 3.4.8, 3.1 to 3.1.17 and earlier unsupported versions|
|Versions fixed:||3.7, 3.6.4, 3.5.6, 3.4.9 and 3.1.18|
|Reported by:||Lindon Wass|
|Tracker issue:||MDL-64708 Open redirect in upload cohorts page|