GitHub Advisoryadvisory · Packagist

GHSA-xxp4-mf4h-6cwm Moodle vulnerable to Server Side Request Forgery

HIGH Published 2023-06-22 Modified 2024-04-19 Official page ↗
Aliases
CVE-2023-35133
Ecosystem
Packagist
Packages
moodle/moodle
Severity
High
CVSS vector
CVSS:3.1/AV:N/AC:L/PR:N/UI:N/S:U/C:H/I:N/A:N
Weaknesses
CWE-918
Reviewed
2023-06-23

Affected packages

• Packagist moodle/moodle: >= 4.2.0, < 4.2.1 → fixed in 4.2.1 • Packagist moodle/moodle: >= 4.1.0, < 4.1.4 → fixed in 4.1.4 • Packagist moodle/moodle: >= 4.0.0, < 4.0.9 → fixed in 4.0.9 • Packagist moodle/moodle: >= 3.10.0, < 3.11.15 → fixed in 3.11.15 • Packagist moodle/moodle: < 3.9.22 → fixed in 3.9.22

Description

An issue in the logic used to check 0.0.0.0 against the cURL blocked hosts lists resulted in an SSRF risk. This flaw affects Moodle versions 4.2, 4.1 to 4.1.3, 4.0 to 4.0.8, 3.11 to 3.11.14, 3.9 to 3.9.21 and earlier unsupported versions.

Related

Alias · CVE (1)

  • CVE-2023-35133 An issue in the logic used to check 0.0.0.0 against the cURL blocked hosts lists resulted in an SSRF risk. vulnerability

Weakness · CWE (1)

  • CWE-918 Server-Side Request Forgery weakness

References