CVE-2023-35133CWE-918

Moodle: ssrf risk due to insufficient check on the curl blocked hosts

High · published June 22, 2023

CVSS v3.1
7.5
EPSS
1%
Percentile
57.0
In the wild
Unconfirmed
What it is

An issue in the logic used to check 0.0.0.0 against the cURL blocked hosts lists resulted in an SSRF risk. This flaw affects Moodle versions 4.2, 4.1 to 4.1.3, 4.0 to 4.0.8, 3.11 to 3.11.14, 3.9 to 3.9.21 and earlier unsupported versions.

The record
Technical detail
CVSS v3.1
7.5 · HIGH
Vector
CVSS:3.1/AV:N/AC:L/PR:N/UI:N/S:U/C:H/I:N/A:N
CVSS v4.0
Not supplied
EPSS
0.00825 · 57.0th percentile
Weakness
CWE-918 · Server-Side Request Forgery (SSRF)
Published
2023-06-22T00:00Z
EPSS history
Timeline
  • 22 JUN 00:00Z
    Moodle: ssrf risk due to insufficient check on the curl blocked hosts
    cvelistv5