Moodle: ssrf risk due to insufficient check on the curl blocked hosts (moodle)
At a glance
- Source
- NVD
- EPSS
- EPSS 0.83 % · percentile 57 ()
- State
- PUBLISHED
- Published
- Updated
- Assigner
- fedora
- NVD status
- Modified
Description
An issue in the logic used to check 0.0.0.0 against the cURL blocked hosts lists resulted in an SSRF risk. This flaw affects Moodle versions 4.2, 4.1 to 4.1.3, 4.0 to 4.0.8, 3.11 to 3.11.14, 3.9 to 3.9.21 and earlier unsupported versions.
Weaknesses (CWE)
- CWE-918 — Server-Side Request Forgery
References
- https://bugzilla.redhat.com/show_bug.cgi?id=2214373
- https://lists.fedoraproject.org/archives/list/package-announce%40lists.fedoraproject.org/message/7A72KX4WU6GK2CX4TKYFGFASPKOEOJFC/
- https://lists.fedoraproject.org/archives/list/package-announce%40lists.fedoraproject.org/message/I5QAEAGJ44NVXLAJFJXKARKC45OGEDXT/
- https://moodle.org/mod/forum/discuss.php?d=447831
Scores
| Version | Score | Vector | Scored by |
|---|---|---|---|
| CVSS 3.1 | HIGH 7.5 | CVSS:3.1/AV:N/AC:L/PR:N/UI:N/S:U/C:H/I:N/A:N | fedora |
| CVSS 3.1 | HIGH 7.5 | CVSS:3.1/AV:N/AC:L/PR:N/UI:N/S:U/C:H/I:N/A:N | NVD · patrick@puiterwijk.org (Secondary) |
| CVSS 3.1 | HIGH 7.5 | CVSS:3.1/AV:N/AC:L/PR:N/UI:N/S:U/C:H/I:N/A:N | NVD · nvd@nist.gov (Primary) |
Advisories
- GHSA-xxp4-mf4h-6cwm — Moodle vulnerable to Server Side Request Forgery
European references
- ENISA EUVD · EUVD-2023-1920
- GCVE · GCVE-0-2023-35133
CERT-FR advisories
- CERTFR-2023-AVI-0476 — Multiples vulnérabilités dans Moodle · cert.ssi.gouv.fr
Affected configurations (NVD CPE)
cpe:2.3:a:moodle:moodle:*:*:*:*:*:*:*:*< 3.9.22cpe:2.3:a:moodle:moodle:*:*:*:*:*:*:*:*≥ 3.11.0 < 3.11.15cpe:2.3:a:moodle:moodle:*:*:*:*:*:*:*:*≥ 4.0.0 < 4.0.9cpe:2.3:a:moodle:moodle:*:*:*:*:*:*:*:*≥ 4.1.0 < 4.1.4cpe:2.3:a:moodle:moodle:4.2.0:*:*:*:*:*:*:*
Affected products
| Product | Versions |
|---|---|
| moodle | affected 4.2.0 < 4.2.1 ; affected 4.1.0 < 4.1.4 ; affected 4.0.0 < 4.0.9 ; affected 3.11.0 < 3.11.15 ; affected 0 < 3.9.22 |
Sources
| Source | Licence |
|---|---|
| CVE List (CVEProject cvelistV5) | CVE Program Terms of Use |
| EPSS (FIRST.org) | FIRST — attribution requested |
| ENISA EUVD | ENISA — reproduction authorised, source acknowledged |
| CERT-FR (ANSSI) | Licence Ouverte / Etalab 2.0 |
| NVD (NIST) via fkie-cad/nvd-json-data-feeds | Public domain — this product uses data from the NVD API but is not endorsed or certified by the NVD |