Moodle vulnerable to Server-Side Request Forgery

HIGH 7.5CVE-2021-36396 · BIT-moodle-2021-36396 · GHSA-4rmj-w58m-fvch · Published 06/03/2023 · updated 17/06/2026

In short

CVE-2021-36396 is a HIGH (CVSS 7.5) vulnerability affecting moodle/moodle, moodle (moodle).
Chance of exploitation in the next 30 days (EPSS): 1.4%, higher than 73.0% of all vulnerabilities.
Fix: update to 3.10.5, 3.11.1, 3.9.8 or later.

Package	Affected versions	Patched versions
moodle/moodle Packagist	`≥ 3.10.0-beta, < 3.10.5≥ 3.11.0-beta, < 3.11.1< 3.9.8`	`3.10.53.11.13.9.8`
moodle moodle	`≥ 3.10.0, < 3.10.5≥ 3.11.0, < 3.11.1< 3.9.8`	`3.10.53.11.13.9.8`

Description

In Moodle, insufficient redirect handling made it possible to blindly bypass cURL blocked hosts/allowed ports restrictions, resulting in a blind SSRF risk.

NVD description

In Moodle, insufficient redirect handling made it possible to blindly bypass cURL blocked hosts/allowed ports restrictions, resulting in a blind SSRF risk.

References

nvd.nist.gov/vuln/detail/CVE-2021-36396 · ADVISORY
moodle/moodle · PACKAGE
moodle.org/mod/forum/discuss.php · WEB

More vulnerabilities in moodle/moodle

See all →

Running one of these products? Scan your site to see whether it exposes a vulnerable version.

Scan my site free

Package

Affected versions

Patched versions

moodle/moodle

Packagist

≥ 3.10.0-beta, < 3.10.5≥ 3.11.0-beta, < 3.11.1< 3.9.8

3.10.53.11.13.9.8

moodle

≥ 3.10.0, < 3.10.5≥ 3.11.0, < 3.11.1< 3.9.8

3.10.53.11.13.9.8

Description

In Moodle, insufficient redirect handling made it possible to blindly bypass cURL blocked hosts/allowed ports restrictions, resulting in a blind SSRF risk.

NVD description

In Moodle, insufficient redirect handling made it possible to blindly bypass cURL blocked hosts/allowed ports restrictions, resulting in a blind SSRF risk.

More vulnerabilities in moodle/moodle

See all →