CVE-2022-45152 is a critical blind Server-Side Request Forgery (SSRF) vulnerability in Moodle, affecting various Fedora Project and Moodle distributions. This flaw stems from insufficient validation of user-supplied input within the LTI provider library, which fails to utilize Moodle's secure cURL helper. An unauthenticated remote attacker can exploit this by sending a specially crafted HTTP request, forcing the application to initiate requests to arbitrary internal or external systems. Rated with a CVSS score of 9.1 (Critical), the vulnerability has a low attack complexity and requires no user interaction or privileges, allowing for high confidentiality and integrity impacts. While the EPSS score is low, indicating a low probability of exploitation, the FAUCET Risk Score is 72/100. Currently, there is no evidence of active exploitation, and no public exploit code is available in Metasploit, Nuclei, or ExploitDB. Community discussion and media coverage for this CVE are minimal, suggesting a lack of widespread attention.
| Vendor | Product | Version(s) | CPE |
|---|---|---|---|
< 3.9.18CPE matchmatch criteria | cpe:2.3:a:moodle:moodle:*:*:*:*:*:*:*:* | ||
>= 3.11.0, < 3.11.11CPE matchmatch criteria | cpe:2.3:a:moodle:moodle:*:*:*:*:*:*:*:* | ||
>= 4.0.0, < 4.0.5CPE matchmatch criteria | cpe:2.3:a:moodle:moodle:*:*:*:*:*:*:*:* | ||
7.0CPE matchmatch criteria | cpe:2.3:a:fedoraproject:extra_packages_for_enterprise_linux:7.0:*:*:*:*:*:*:* | ||
35CPE matchmatch criteria | cpe:2.3:o:fedoraproject:fedora:35:*:*:*:*:*:*:* |
CVSS version used by this source: 3.1
CVSS:3.1/AV:N/AC:L/PR:N/UI:N/S:U/C:H/I:H/A:N
The average CVE in this peer group has 0.0 Twitter, 0.1 Reddit, 0.3 Bluesky, 0.3 Mastodon, and 2.4 GitHub mentions.
No media coverage found for this CVE.
The average CVE in this peer group has 0.3 InfoSec Media, 0.0 Vendor Blog, and 0.0 Security Researcher mentions.