NetSight
IP …
critical9.1

CVE-2022-45152

A blind Server-Side Request Forgery (SSRF) vulnerability was found in Moodle.

Impact

A blind Server-Side Request Forgery (SSRF) vulnerability was found in Moodle. This flaw exists due to insufficient validation of user-supplied input in LTI provider library. The library does not utilise Moodle's inbuilt cURL helper, which resulted in a blind SSRF risk. An attacker can send a specially crafted HTTP request and trick the application to initiate requests to arbitrary systems. This vulnerability allows a remote attacker to perform SSRF attacks.

Affected products

VendorProductAffected versions
MoodleMoodle
before 3.9.18
from 3.11.0 before 3.11.11
from 4.0.0 before 4.0.5
FedoraprojectExtra Packages For Enterprise Linux
Version 7.0
FedoraprojectFedora
Versions 35, 36, 37

Weakness classification

CWE-918

References