VYPR
← All advisories
Critical severity9.1NVD Advisory· Published Nov 25, 2022· Updated Jun 17, 2026

CVE-2022-45152

CVE-2022-45152

Description

A blind Server-Side Request Forgery (SSRF) vulnerability was found in Moodle. This flaw exists due to insufficient validation of user-supplied input in LTI provider library. The library does not utilise Moodle's inbuilt cURL helper, which resulted in a blind SSRF risk. An attacker can send a specially crafted HTTP request and trick the application to initiate requests to arbitrary systems. This vulnerability allows a remote attacker to perform SSRF attacks.

AI Insight

LLM-synthesized narrative grounded in this CVE's description and references.

Affected packages

Versions sourced from the GitHub Security Advisory.

PackageAffected versionsPatched versions
moodle/moodlePackagist
>= 3.9, < 3.9.183.9.18
moodle/moodlePackagist
>= 3.11, < 3.11.113.11.11
moodle/moodlePackagist
>= 4.0, < 4.0.54.0.5

Affected products

8
  • Fedoraproject/Extra Packages For Enterprise Linux
    cpe:2.3:a:fedoraproject:extra_packages_for_enterprise_linux:7.0:*:*:*:*:*:*:*
  • Moodle/Moodle2 versions
    cpe:2.3:a:moodle:moodle:*:*:*:*:*:*:*:*+ 1 more
    • cpe:2.3:a:moodle:moodle:*:*:*:*:*:*:*:*range: <3.9.18
    • (no CPE)
  • Fedoraproject/Fedora3 versions
    cpe:2.3:o:fedoraproject:fedora:35:*:*:*:*:*:*:*+ 2 more
    • cpe:2.3:o:fedoraproject:fedora:35:*:*:*:*:*:*:*
    • cpe:2.3:o:fedoraproject:fedora:36:*:*:*:*:*:*:*
    • cpe:2.3:o:fedoraproject:fedora:37:*:*:*:*:*:*:*
  • osv-coords2 versions
    pkg:bitnami/moodlepkg:composer/moodle/moodle
    < 3.9.18+ 1 more
    • (no CPE)range: < 3.9.18
    • (no CPE)range: >= 3.9, < 3.9.18

Patches

Vulnerability mechanics

References

13

News mentions

0

No linked articles in our index yet.