~ / search / GHSA-xxp4-mf4h-6cwm

GHSA-xxp4-mf4h-6cwm

Moodle vulnerable to Server Side Request Forgery

Source: GitHub Advisory Database (reviewed) High CVE-2023-35133

Packages

EcosystemPackageAffectedFixed in
Packagist moodle/moodle >= 4.2.0, < 4.2.1 4.2.1
Packagist moodle/moodle >= 4.1.0, < 4.1.4 4.1.4
Packagist moodle/moodle >= 4.0.0, < 4.0.9 4.0.9
Packagist moodle/moodle >= 3.10.0, < 3.11.15 3.11.15
Packagist moodle/moodle < 3.9.22 3.9.22

Details

As written in the advisory (Markdown source, shown as plain text).

An issue in the logic used to check 0.0.0.0 against the cURL blocked hosts lists resulted in an SSRF risk. This flaw affects Moodle versions 4.2, 4.1 to 4.1.3, 4.0 to 4.0.8, 3.11 to 3.11.14, 3.9 to 3.9.21 and earlier unsupported versions.

References

External links from the advisory. They lead to third-party sites.