PT-2023-25158 · Moodle+2 · Moodle+2

Mateo Hanžek · Published 2020-11-08 · Updated 2024-04-19 · CVE-2023-35133

Positive Technologies (AI Summary)

CVSS v3.1

7.5

High

Base vector

AV:N/AC:L/PR:N/UI:N/S:U/C:H/I:N/A:N

Name of the Vulnerable Software and Affected Versions Moodle versions 3.9 to 3.9.21 Moodle versions 3.11 to 3.11.14 Moodle versions 4.0 to 4.0.8 Moodle versions 4.1 to 4.1.3 Moodle version 4.2

Description The issue is related to the logic used to check 0.0.0.0 against the cURL blocked hosts lists, resulting in a Server-Side Request Forgery (SSRF) risk. This allows an attacker to send a specially crafted HTTP request, forcing the application to initiate requests to arbitrary systems. Exploitation of this issue may enable a remote attacker to access confidential data located in the local network or send malicious requests to other servers from the vulnerable system.

Recommendations For Moodle version 4.2, update to a version that includes the fix for this issue. For Moodle versions 4.1 to 4.1.3, update to a version that includes the fix for this issue. For Moodle versions 4.0 to 4.0.8, update to a version that includes the fix for this issue. For Moodle versions 3.11 to 3.11.14, update to a version that includes the fix for this issue. For Moodle versions 3.9 to 3.9.21, update to a version that includes the fix for this issue. As a temporary workaround, consider restricting access to the cURL functionality until a patch is available.

Fix

SSRF

Weakness Enumeration

CWE-918

Related Identifiers

ALT-PU-2020-3235

ALT-PU-2020-3289

ALT-PU-2023-2012

ALT-PU-2023-2057

ALT-PU-2023-5127

BIT-MOODLE-2023-35133

CVE-2023-35133

GHSA-XXP4-MF4H-6CWM

Affected Products

Alt Linux

Moodle

Red Os

References · 17

• https://lists.fedoraproject.org/archives/list/[e-mail]/message/7A72KX4WU6GK2CX4TKYFGFASPKOEOJFC · Vendor Advisory
• https://cve.org/CVERecord?id=CVE-2023-35133 · Security Note
• https://osv.dev/vulnerability/GHSA-xxp4-mf4h-6cwm · Vendor Advisory
• https://osv.dev/vulnerability/BIT-moodle-2023-35133 · Vendor Advisory
• https://moodle.org/mod/forum/discuss.php?d=447831 · Vendor Advisory
• https://lists.fedoraproject.org/archives/list/package-announce%40lists.fedoraproject.org/message/7A72KX4WU6GK2CX4TKYFGFASPKOEOJFC · Vendor Advisory
• https://lists.fedoraproject.org/archives/list/package-announce%40lists.fedoraproject.org/message/I5QAEAGJ44NVXLAJFJXKARKC45OGEDXT · Vendor Advisory
• https://osv.dev/vulnerability/CVE-2023-35133 · Vendor Advisory
• https://osv.dev/vulnerability/UBUNTU-CVE-2023-35133 · Vendor Advisory
• https://nvd.nist.gov/vuln/detail/CVE-2023-35133 · Security Note
• https://lists.fedoraproject.org/archives/list/[e-mail]/message/I5QAEAGJ44NVXLAJFJXKARKC45OGEDXT · Vendor Advisory
• https://ubuntu.com/security/CVE-2023-35133 · Vendor Advisory
• https://github.com/moodle/moodle · Note
• https://bugzilla.redhat.com/show_bug.cgi?id=2214373 · Note
• https://t.me/cvenotify/77442 · Telegram Post