Description

An issue in the logic used to check 0.0.0.0 against the cURL blocked hosts lists resulted in an SSRF risk. This flaw affects Moodle versions 4.2, 4.1 to 4.1.3, 4.0 to 4.0.8, 3.11 to 3.11.14, 3.9 to 3.9.21 and earlier unsupported versions.

Remediation

References

CVE-2023-35133

Related Vulnerabilities

Oracle HTTP Server Integer Overflow or Wraparound Vulnerability (CVE-2022-25314)

e107 Improper Neutralization of Input During Web Page Generation ('Cross-site Scripting') Vulnerability (CVE-2012-3843)

Oracle Application Server CVE-2007-5519 Vulnerability (CVE-2007-5519)

WordPress 3.7.x Multiple Vulnerabilities (3.7 - 3.7.27)

WordPress Plugin SS Downloads Multiple Cross-Site Scripting Vulnerabilities (1.4.4.1)

Severity

High

Classification

CVE-2023-35133 CWE-918 CVSS:3.1/AV:N/AC:L/PR:N/UI:N/S:U/C:H/I:N/A:N

Tags

Missing Update Known Vulnerabilities