CVE-2022-45152

A blind Server-Side Request Forgery (SSRF) vulnerability was found in Moodle. This flaw exists due to insufficient validation of user-supplied input in LTI provider library. The library does not utilise Moodle's inbuilt cURL helper, which resulted in a blind SSRF risk. An attacker can send a specially crafted HTTP request and trick the application to initiate requests to arbitrary systems. This vulnerability allows a remote attacker to perform SSRF attacks.

• CWE-918
• CWE-918
• CWE-918

• http://git.moodle.org/gw?p=moodle.git&a=search&h=HEAD&st=commit&s=MDL-71920
• https://bugzilla.redhat.com/show_bug.cgi?id=2142775
• https://lists.fedoraproject.org/archives/list/package-announce%40lists.fedoraproject.org/message/2DHYIIAUXUBHMBEDYU7TYNZXEN2W2SA2/
• https://lists.fedoraproject.org/archives/list/package-announce%40lists.fedoraproject.org/message/74SXNGA5RIWM7QNX7H3G7SYIQLP4UUGV/
• https://lists.fedoraproject.org/archives/list/package-announce%40lists.fedoraproject.org/message/NLRJB5JNKK3VVBLV3NH3RI7COEDAXSAB/
• https://moodle.org/mod/forum/discuss.php?d=440772
• http://git.moodle.org/gw?p=moodle.git&a=search&h=HEAD&st=commit&s=MDL-71920
• https://bugzilla.redhat.com/show_bug.cgi?id=2142775
• https://lists.fedoraproject.org/archives/list/package-announce%40lists.fedoraproject.org/message/2DHYIIAUXUBHMBEDYU7TYNZXEN2W2SA2/
• https://lists.fedoraproject.org/archives/list/package-announce%40lists.fedoraproject.org/message/74SXNGA5RIWM7QNX7H3G7SYIQLP4UUGV/
• https://lists.fedoraproject.org/archives/list/package-announce%40lists.fedoraproject.org/message/NLRJB5JNKK3VVBLV3NH3RI7COEDAXSAB/
• https://moodle.org/mod/forum/discuss.php?d=440772

Published

Nov 25, 2022

Last Modified

Jun 17, 2026

Status

Modified

• One Click Account Takeover in GranolaHow a notification link broke out of Electron and led to a one-click account takeover.
• Autonomous PentestingAI agents that find and validate exploitable vulnerabilities like this one across your applications.
• PR ReviewsPentest every pull request so vulnerable code is caught before it ships to production.
• AI Penetration TestingHow AI-driven penetration testing continuously covers your attack surface.

• CVE-2022-45147A vulnerability has been identified in SIMATIC PCS neo V4.0 …8.5
• CVE-2022-45148Rejected reason: DO NOT USE THIS CANDIDATE NUMBER. ConsultID…
• CVE-2022-45149A vulnerability was found in Moodle which exists due to insu…5.4
• CVE-2022-4515A flaw was found in Exuberant Ctags in the way it handles th…7.8
• CVE-2022-45150A reflected cross-site scripting vulnerability was discovere…6.1
• CVE-2022-45151The stored-XSS vulnerability was discovered in Moodle which …5.4
• CVE-2022-45153An Incorrect Default Permissions vulnerability in saphanaboo…7.8
• CVE-2022-45154A Cleartext Storage of Sensitive Information vulnerability i…5.5
• CVE-2022-45155An Improper Handling of Exceptional Conditions vulnerability…5.5
• CVE-2022-45157A vulnerability has been identified in the way that Rancher …9.1
• CVE-2022-4516Rejected reason: DO NOT USE THIS CANDIDATE NUMBER. ConsultID…
• CVE-2022-45163An information-disclosure vulnerability exists on select NXP…4.6