CVE-2022-45149: CSRF
A vulnerability was found in Moodle which exists due to insufficient validation of the HTTP request origin in course redirect URL. A user's CSRF token was unnecessarily included in the URL when being redirected to a course they have just restored. A remote attacker can trick the victim to visit a specially crafted web page and perform arbitrary actions on behalf of the victim on the vulnerable website. This flaw allows an attacker to perform cross-site request forgery attacks.
Other sources
MSA-22-0029: Course restore - CSRF token passed in course redirect URL
A user's CSRF token (Moodle sesskey) was unnecessarily included in the URL when being redirected to a course they have just restored.
Versions affected: 4.0 to 4.0.4, 3.11 to 3.11.10, 3.9 to 3.9.17 and earlier unsupported versions Versions fixed: 4.0.5, 3.11.11 and 3.9.18
— Red Hat
Affected Software
Remediation
Recommended actions to resolve this vulnerability, in priority order.
- Upgrade
Upgrade
redhat/moodleto a version that resolves this vulnerability.Fixed in 4.0.5 - Upgrade
Upgrade
redhat/moodleto a version that resolves this vulnerability.Fixed in 3.11.11 - Upgrade
Upgrade
redhat/moodleto a version that resolves this vulnerability.Fixed in 3.9.18 - Upgrade
Upgrade
Moodleto a version that resolves this vulnerability.Fixed in 4.0.5 - Upgrade
Upgrade
Moodleto a version that resolves this vulnerability.Fixed in 3.11.11 - Upgrade
Upgrade
Moodleto a version that resolves this vulnerability.Fixed in 3.9.18 - Compensating control
Until upgraded, ensure course redirect URLs do not include the Moodle sesskey/CSRF token in query parameters or the URL; rely on server-side session validation instead of passing sesskey via the redirect URL.
Event History
Frequently Asked Questions
What is the vulnerability ID for this Moodle vulnerability?
The vulnerability ID for this Moodle vulnerability is CVE-2022-45149.
What is the severity of CVE-2022-45149?
The severity of CVE-2022-45149 is medium with a CVSS score of 5.4.
How does the vulnerability in Moodle occur?
The vulnerability in Moodle occurs due to insufficient validation of the HTTP request origin in course redirect URL.
Which versions of Moodle are affected by CVE-2022-45149?
Versions 3.9.0 to 3.9.18, 3.11.0 to 3.11.11, and 4.0.0 to 4.0.5 of Moodle are affected by CVE-2022-45149.
How can I fix the vulnerability in Moodle?
To fix the vulnerability in Moodle, update to version 3.9.18, 3.11.11, or 4.0.5, which contain the necessary patches.