GHSA-xxp4-mf4h-6cwm
Moodle vulnerable to Server Side Request Forgery
At a glance
- Published
- Updated
- CVE
- CVE-2023-35133
- Aliases
- BIT-moodle-2023-35133
- CVSS_V3
- CVSS:3.1/AV:N/AC:L/PR:N/UI:N/S:U/C:H/I:N/A:N
Description
An issue in the logic used to check 0.0.0.0 against the cURL blocked hosts lists resulted in an SSRF risk. This flaw affects Moodle versions 4.2, 4.1 to 4.1.3, 4.0 to 4.0.8, 3.11 to 3.11.14, 3.9 to 3.9.21 and earlier unsupported versions.
Affected packages
| Package | Versions |
|---|---|
| Packagist · moodle/moodle | introduced 4.2.0, fixed 4.2.1 |
| Packagist · moodle/moodle | introduced 4.1.0, fixed 4.1.4 |
| Packagist · moodle/moodle | introduced 4.0.0, fixed 4.0.9 |
| Packagist · moodle/moodle | introduced 3.10.0, fixed 3.11.15 |
| Packagist · moodle/moodle | introduced 0, fixed 3.9.22 |
References
- https://nvd.nist.gov/vuln/detail/CVE-2023-35133 ADVISORY
- https://bugzilla.redhat.com/show_bug.cgi?id=2214373 WEB
- https://github.com/moodle/moodle PACKAGE
- https://lists.fedoraproject.org/archives/list/package-announce%40lists.fedoraproject.org/message/7A72KX4WU6GK2CX4TKYFGFASPKOEOJFC WEB
- https://lists.fedoraproject.org/archives/list/package-announce%40lists.fedoraproject.org/message/I5QAEAGJ44NVXLAJFJXKARKC45OGEDXT WEB
- https://lists.fedoraproject.org/archives/list/package-announce@lists.fedoraproject.org/message/7A72KX4WU6GK2CX4TKYFGFASPKOEOJFC WEB
- https://lists.fedoraproject.org/archives/list/package-announce@lists.fedoraproject.org/message/I5QAEAGJ44NVXLAJFJXKARKC45OGEDXT WEB
- https://moodle.org/mod/forum/discuss.php?d=447831 WEB
- http://git.moodle.org/gw?p=moodle.git&a=search&h=HEAD&st=commit&s=MDL-78215 WEB
Sources
| Source | Licence |
|---|---|
| OSV.dev | CC-BY 4.0 — GitHub Advisory Database |