| Package | Affected versions | Patched versions |
|---|---|---|
| moodle/moodle | ≥ 3.11, < 3.11.11≥ 3.9, < 3.9.18≥ 4.0, < 4.0.5 | 3.11.113.9.184.0.5 |
| extra packages for enterprise linux | = 7.0 | |
| moodle | ≥ 3.11.0, < 3.11.11≥ 4.0.0, < 4.0.5< 3.9.18 | 3.11.114.0.53.9.18 |
A blind Server-Side Request Forgery (SSRF) vulnerability was found in Moodle. This flaw exists due to insufficient validation of user-supplied input in LTI provider library. The library does not utilise Moodle's inbuilt cURL helper, which resulted in a blind SSRF risk. An attacker can send a specially crafted HTTP request and trick the application to initiate requests to arbitrary systems. This vulnerability allows a remote attacker to perform SSRF attacks.
Running one of these products? Scan your site to see whether it exposes a vulnerable version.
Scan my site free