CVE-2023-35133: Moodle: ssrf risk due to insufficient check on the curl blocked hosts
First published: Mon Jun 12 2023(Updated: )
An issue in the logic used to check 0.0.0.0 against the cURL blocked hosts lists resulted in an SSRF risk. This flaw affects Moodle versions 4.2, 4.1 to 4.1.3, 4.0 to 4.0.8, 3.11 to 3.11.14, 3.9 to 3.9.21 and earlier unsupported versions.
Credit: patrick@puiterwijk.org patrick@puiterwijk.org patrick@puiterwijk.org
| Affected Software | Affected Version | How to fix |
|---|---|---|
| Moodle Moodle | <3.9.22 | |
| Moodle Moodle | >=3.11.0<3.11.15 | |
| Moodle Moodle | >=4.0.0<4.0.9 | |
| Moodle Moodle | >=4.1.0<4.1.4 | |
| Moodle Moodle | =4.2.0 | |
| composer/moodle/moodle | <3.9.22 | 3.9.22 |
| composer/moodle/moodle | >=3.10.0<3.11.15 | 3.11.15 |
| composer/moodle/moodle | >=4.0.0<4.0.9 | 4.0.9 |
| composer/moodle/moodle | >=4.1.0<4.1.4 | 4.1.4 |
| composer/moodle/moodle | =4.2.0 | 4.2.1 |
| redhat/moodle | <4.2.1 | 4.2.1 |
| redhat/moodle | <4.1.4 | 4.1.4 |
| redhat/moodle | <4.0.9 | 4.0.9 |
| redhat/moodle | <3.11.15 | 3.11.15 |
| redhat/moodle | <3.9.22 | 3.9.22 |
| <3.9.22 | ||
| >=3.11.0<3.11.15 | ||
| >=4.0.0<4.0.9 | ||
| >=4.1.0<4.1.4 | ||
| =4.2.0 |
Never miss a vulnerability like this again
Sign up to SecAlerts for real-time vulnerability data matched to your software, aggregated from hundreds of sources.
Reference Links
- https://lists.fedoraproject.org/archives/list/package-announce@lists.fedoraproject.org/message/7A72KX4WU6GK2CX4TKYFGFASPKOEOJFC/
- https://lists.fedoraproject.org/archives/list/package-announce@lists.fedoraproject.org/message/I5QAEAGJ44NVXLAJFJXKARKC45OGEDXT/
- https://moodle.org/mod/forum/discuss.php?d=447831
- https://nvd.nist.gov/vuln/detail/CVE-2023-35133
- http://git.moodle.org/gw?p=moodle.git&a=search&h=HEAD&st=commit&s=MDL-78215
- https://github.com/advisories/GHSA-xxp4-mf4h-6cwm (Advisory)
- https://bugzilla.redhat.com/show_bug.cgi?id=2214373
- https://lists.fedoraproject.org/archives/list/package-announce%40lists.fedoraproject.org/message/7A72KX4WU6GK2CX4TKYFGFASPKOEOJFC/
- https://lists.fedoraproject.org/archives/list/package-announce%40lists.fedoraproject.org/message/I5QAEAGJ44NVXLAJFJXKARKC45OGEDXT/
- https://bugzilla.redhat.com/show_bug.cgi/show_bug.cgi?id=2216004
- https://bugzilla.redhat.com/show_bug.cgi/show_bug.cgi?id=2216003
- https://lists.fedoraproject.org/archives/list/package-announce%40lists.fedoraproject.org/message/7A72KX4WU6GK2CX4TKYFGFASPKOEOJFC
- https://lists.fedoraproject.org/archives/list/package-announce%40lists.fedoraproject.org/message/I5QAEAGJ44NVXLAJFJXKARKC45OGEDXT
- https://lists.fedoraproject.org/archives/list/package-announce@lists.fedoraproject.org/message/7A72KX4WU6GK2CX4TKYFGFASPKOEOJFC
- https://lists.fedoraproject.org/archives/list/package-announce@lists.fedoraproject.org/message/I5QAEAGJ44NVXLAJFJXKARKC45OGEDXT
Frequently Asked Questions
What is the severity of CVE-2023-35133?
The severity of CVE-2023-35133 is high, with a severity value of 7.5.
Which versions of Moodle are affected by CVE-2023-35133?
Moodle versions 4.2, 4.1 to 4.1.3, 4.0 to 4.0.8, 3.11 to 3.11.14, 3.9 to 3.9.21 and earlier unsupported versions are affected by CVE-2023-35133.
What is the risk associated with CVE-2023-35133?
CVE-2023-35133 poses an SSRF risk.
How can I mitigate the vulnerability in Moodle?
To mitigate the vulnerability in Moodle, it is recommended to upgrade to the latest supported version or apply the necessary patches provided by Moodle.
Where can I find more information about CVE-2023-35133?
Additional information about CVE-2023-35133 can be found in the references section of the vulnerability description.
- collector/nvd-index
- agent/type
- collector/mitre-cve
- source/MITRE
- agent/weakness
- agent/title
- agent/remedy
- collector/redhat-bugzilla
- source/Red Hat
- alias/CVE-2023-35133
- agent/software-canonical-lookup
- agent/severity
- agent/description
- agent/first-publish-date
- collector/nvd-api
- source/NVD
- agent/author
- collector/github-advisory-latest
- source/GitHub
- alias/GHSA-xxp4-mf4h-6cwm
- agent/last-modified-date
- agent/references
- agent/tags
- agent/softwarecombine
- agent/event
- collector/nvd-cve
- collector/github-advisory
- vendor/moodle
- canonical/moodle moodle
- version/moodle moodle/3.11.0
- version/moodle moodle/4.0.0
- version/moodle moodle/4.1.0
- version/moodle moodle/4.2.0
- package-manager/redhat
- package-manager/composer