A blind Server-Side Request Forgery (SSRF) vulnerability was found in Moodle. This flaw exists due to insufficient validation of user-supplied input in LTI provider library. The library does not utilise Moodle's inbuilt cURL helper, which resulted in a blind SSRF risk. An attacker can send a specially crafted HTTP request and trick the application to initiate requests to arbitrary systems. This vulnerability allows a remote malicious user to perform SSRF attacks.
| Vulnerable Product | Search on Vulmon | Subscribe to Product |
|---|---|---|
moodle moodle |
||
fedoraproject fedora 35 |
||
fedoraproject fedora 36 |
||
fedoraproject extra packages for enterprise linux 7.0 |
||
fedoraproject fedora 37 |
Vulmon