QwikSec

Security Database

CVE

CWE

Training

CVE-2022-45152

Published: Nov 25, 2022

Modified: Apr 29, 2025

PUBLISHED

Description

A blind Server-Side Request Forgery (SSRF) vulnerability was found in Moodle. This flaw exists due to insufficient validation of user-supplied input in LTI provider library. The library does not utilise Moodle's inbuilt cURL helper, which resulted in a blind SSRF risk. An attacker can send a specially crafted HTTP request and trick the application to initiate requests to arbitrary systems. This vulnerability allows a remote attacker to perform SSRF attacks.

Vendor	Product	Versions
n/a	Moodle	affected `Fixed in moodle 4.0.5, moodle 3.11.11, moodle 3.9.18`

Weaknesses (CWE)

References

https://bugzilla.redhat.com/show_bug.cgi?id=2142775

https://moodle.org/mod/forum/discuss.php?d=440772

http://git.moodle.org/gw?p=moodle.git&a=search&h=HEAD&st=commit&s=MDL-71920

FEDORA-2022-f7fdcb1820

vendor-advisory

FEDORA-2022-cb7084ae1c

vendor-advisory

FEDORA-2022-74a9c8e95f

vendor-advisory

Security Training

Train your team to recognize and prevent security threats with our comprehensive security awareness program.

Vulnerability Scanning

Discover vulnerabilities in your applications and infrastructure before attackers do.