CVE-2023-35133: An issue in the logic used to check 0.0.0.0 against the cURL blocked hosts lists resulted in an SSRF risk

High severity · published Jun 22, 2023

CVE-2023-35133

An issue in the logic used to check 0.0.0.0 against the cURL blocked hosts lists resulted in an SSRF risk

7.5

CVSS

0.8%

EPSS

On KEV

Description

An issue in the logic used to check 0.0.0.0 against the cURL blocked hosts lists resulted in an SSRF risk. This flaw affects Moodle versions 4.2, 4.1 to 4.1.3, 4.0 to 4.0.8, 3.11 to 3.11.14, 3.9 to 3.9.21 and earlier unsupported versions.

CVSS vector

CVSS:3.1/AV:N/AC:L/PR:N/UI:N/S:U/C:H/I:N/A:N

Attack vector

Network

Complexity

Low

Privileges

None

User interaction

None

Confidentiality

High

Integrity

None

Availability

None

Scope

Unchanged

Exploitation

Is it being used?

Exploit prediction (EPSS)0.8% · higher than 57% of CVEs

Exploited in the wildNo evidence yet

CISA KEVNot listed

Ransomware campaign useNot known

Affected products

Which versions

Moodle · Moodle

before 3.9.22; 3.11.0 before 3.11.15; 4.0.0 before 4.0.9; 4.1.0 before 4.1.4; 4.2.0 · source: NVD

Affected product

Moodle

All Moodle CVEs

References

NVD

https://nvd.nist.gov/vuln/detail/CVE-2023-35133

CVE.org

https://www.cve.org/CVERecord?id=CVE-2023-35133

bugzilla.redhat.com

https://bugzilla.redhat.com/show_bug.cgi?id=2214373

lists.fedoraproject.org

https://lists.fedoraproject.org/archives/list/package-announce%40lists.fedoraproject.org/message/7A72KX4WU6GK2CX4TKYFGFASPKOEOJFC/

lists.fedoraproject.org

https://lists.fedoraproject.org/archives/list/package-announce%40lists.fedoraproject.org/message/I5QAEAGJ44NVXLAJFJXKARKC45OGEDXT/

Patch

https://moodle.org/mod/forum/discuss.php?d=447831