CVE-2022-45149
MEDIUMMoodle 3.9.0-3.9.17 - Cross-Site Request Forgery via Course Redirect URL
Title source: llmDescription
A vulnerability was found in Moodle which exists due to insufficient validation of the HTTP request origin in course redirect URL. A user's CSRF token was unnecessarily included in the URL when being redirected to a course they have just restored. A remote attacker can trick the victim to visit a specially crafted web page and perform arbitrary actions on behalf of the victim on the vulnerable website. This flaw allows an attacker to perform cross-site request forgery attacks.
References (6)
Core 6
Core References
Various Sources
https://moodle.org/mod/forum/discuss.php?d=440769
Issue Tracking
https://bugzilla.redhat.com/show_bug.cgi?id=2142772
Mailing List, Third Party Advisory vendor-advisory
https://lists.fedoraproject.org/archives/list/package-announce%40lists.fedoraproject.org/message/74SXNGA5RIWM7QNX7H3G7SYIQLP4UUGV/
Mailing List, Third Party Advisory vendor-advisory
https://lists.fedoraproject.org/archives/list/package-announce%40lists.fedoraproject.org/message/NLRJB5JNKK3VVBLV3NH3RI7COEDAXSAB/
Mailing List, Third Party Advisory vendor-advisory
https://lists.fedoraproject.org/archives/list/package-announce%40lists.fedoraproject.org/message/2DHYIIAUXUBHMBEDYU7TYNZXEN2W2SA2/
Scores
CVSS v3
5.4
EPSS
0.0030
EPSS Percentile
53.7%
Attack Vector
NETWORK
CVSS:3.1/AV:N/AC:L/PR:N/UI:R/S:U/C:L/I:L/A:N
CISA SSVC
Vulnrichment
Exploitation
none
Automatable
no
Technical Impact
partial
Details
CWE
CWE-352
Status
published
Products (5)
fedoraproject/fedora
35
fedoraproject/fedora
36
fedoraproject/fedora
37
moodle/moodle
3.9.0 - 3.9.18
moodle/moodle
3.9.0 - 3.9.18Packagist
Published
Nov 23, 2022
Tracked Since
Feb 18, 2026