NetSight
IP …
medium5.4

CVE-2022-45149

Cross-Site Request Forgery in Moodle

Impact

A vulnerability was found in Moodle which exists due to insufficient validation of the HTTP request origin in course redirect URL. A user's CSRF token was unnecessarily included in the URL when being redirected to a course they have just restored. A remote attacker can trick the victim to visit a specially crafted web page and perform arbitrary actions on behalf of the victim on the vulnerable website. This flaw allows an attacker to perform cross-site request forgery attacks.

Affected packages

EcosystemPackageAffectedFixed in
composermoodle/moodle>= 3.9.0, < 3.9.183.9.18

Affected products

VendorProductAffected versions
MoodleMoodle
from 3.9.0 before 3.9.18
from 3.11.0 before 3.11.11
from 4.0.0 before 4.0.5
FedoraprojectFedora
Versions 35, 36, 37

Weakness classification

CWE-352

References