CVE-2022-45149
Medium
Description
A vulnerability was found in Moodle which exists due to insufficient validation of the HTTP request origin in course redirect URL. A user's CSRF token was unnecessarily included in the URL when being redirected to a course they have just restored. A remote attacker can trick the victim to visit a specially crafted web page and perform arbitrary actions on behalf of the victim on the vulnerable website. This flaw allows an attacker to perform cross-site request forgery attacks.
SeverityMedium
CVSS5.4
Exploit probability—
Product
Moodle
PublishedNov 23, 2022
First seenNov 23, 2022
Weakness typeCWE-352Cross-site request forgery (CSRF)
How to fix
Update
- moodle moodle3.9.18, 3.11.11, 4.0.5 or later
- moodle/moodle3.9.18, 3.11.11, 4.0.5 or later
Vendor advisories
- lists.fedoraproject.org/archives/list/package-announce%40lists.fedoraproject.org/message/74SXNGA5RIWM7QNX7H3G7SYIQLP4UUGV/
- lists.fedoraproject.org/archives/list/package-announce%40lists.fedoraproject.org/message/NLRJB5JNKK3VVBLV3NH3RI7COEDAXSAB/
- lists.fedoraproject.org/archives/list/package-announce%40lists.fedoraproject.org/message/2DHYIIAUXUBHMBEDYU7TYNZXEN2W2SA2/
Affected products
| Product | Affected versions | Fixed in |
|---|---|---|
| moodle moodle | 3.9.0 ≤ v < 3.9.18, 3.11.0 ≤ v < 3.11.11, 4.0.0 ≤ v < 4.0.5 | 3.9.18, 3.11.11, 4.0.5 |
| fedoraproject fedora | 35, 36, 37 | — |
| moodle/moodlePackagist | 3.9.0 ≤ v < 3.9.18, 3.11.0 ≤ v < 3.11.11, 4.0.0 ≤ v < 4.0.5 | 3.9.18, 3.11.11, 4.0.5 |
Check your version
Choose the product and enter the version you run to see whether it falls in the affected range.
In the Intelligence 360 plan
Attack Surface Management
See the assets tied to your domains, the technologies they run and known vulnerabilities in one list.