CVE-2023-35133
Moodle: ssrf risk due to insufficient check on the curl blocked hosts
Résumé
Moodle: ssrf risk due to insufficient check on the curl blocked hosts
Description d'origine
La description telle que publiée par la source (souvent en anglais).
An issue in the logic used to check 0.0.0.0 against the cURL blocked hosts lists resulted in an SSRF risk. This flaw affects Moodle versions 4.2, 4.1 to 4.1.3, 4.0 to 4.0.8, 3.11 to 3.11.14, 3.9 to 3.9.21 and earlier unsupported versions.
Source: OSV.dev (Open Source Vulnerabilities) NVD GitHub Advisory OSV
Paquets affectés
Bitnami
moodle
[{"type":"SEMVER","events":[{"introduced":"0"},{"fixed":"3.9.22"},{"introduced":"3.11.0"},{"fixed":"3.11.15"},{"introduced":"4.0.0"},{"fixed":"4.0.9"},{"introduced":"4.1.0"},{"fixed":"4.1.4"},{"introduced":"4.2.0"},{"fixed":"4.2.1"}]}]
Références
- advisory lists.fedoraproject.org
- advisory lists.fedoraproject.org
- advisory nvd.nist.gov
- advisory github.com
- report bugzilla.redhat.com
- web moodle.org
- web git.moodle.org