Every CVE Search/ Get API key

CVE-2022-45152

Moodle blind Server-Side Request Forgery (SSRF) vulnerability in LTI provider library

9.1 CriticalFix available

A blind Server-Side Request Forgery (SSRF) vulnerability was found in Moodle. This flaw exists due to insufficient validation of user-supplied input in LTI provider library. The library does not utilise Moodle's inbuilt cURL helper, which resulted in a blind SSRF risk. An attacker can send a specially crafted HTTP request and trick the application to initiate requests to arbitrary systems. This vulnerability allows a remote attacker to perform SSRF attacks.

Attack profile

How easy it is to exploit

Attack vector
Network
Complexity
Low
Privileges needed
None
User interaction
None

What an attacker can affect

Confidentiality
High
Integrity
High
Availability
None

Exploit likelihood

1.47%Up 0.4 points since Nov 26, 2022
90%50%10%1%

What each source reports

NVD Score used 9.1

A blind Server-Side Request Forgery (SSRF) vulnerability was found in Moodle. This flaw exists due to insufficient validation of user-supplied input in LTI provider library. The library does not utilise Moodle's inbuilt cURL helper, which resulted in a blind SSRF risk. An attacker can send a specially crafted HTTP request and trick the application to initiate requests to arbitrary systems. This vulnerability allows a remote attacker to perform SSRF attacks.

Record
CVE-2022-45152
CVSS 3.1
9.1 CriticalCVSS:3.1/AV:N/AC:L/PR:N/UI:N/S:U/C:H/I:H/A:N
Weakness
CWE-918
Updated
2026-11-02
CVE List 9.1

A blind Server-Side Request Forgery (SSRF) vulnerability was found in Moodle. This flaw exists due to insufficient validation of user-supplied input in LTI provider library. The library does not utilise Moodle's inbuilt cURL helper, which resulted in a blind SSRF risk. An attacker can send a specially crafted HTTP request and trick the application to initiate requests to arbitrary systems. This vulnerability allows a remote attacker to perform SSRF attacks.

Record
CVE-2022-45152
CVSS 3.1
9.1 CriticalCVSS:3.1/AV:N/AC:L/PR:N/UI:N/S:U/C:H/I:H/A:N
Weakness
CWE-918, CWE-918
Updated
2026-11-02
EUVDEUVD-2022-7466 9.1

A blind Server-Side Request Forgery (SSRF) vulnerability was found in Moodle. This flaw exists due to insufficient validation of user-supplied input in LTI provider library. The library does not utilise Moodle's inbuilt cURL helper, which resulted in a blind SSRF risk. An attacker can send a specially crafted HTTP request and trick the application to initiate requests to arbitrary systems. This vulnerability allows a remote attacker to perform SSRF attacks.

Record
EUVD-2022-7466
CVSS 3.1
9.1 CriticalCVSS:3.1/AV:N/AC:L/PR:N/UI:N/S:U/C:H/I:H/A:N
Updated
2026-11-02
GitHub AdvisoriesGHSA-xqcf-vgqc-pcmg 9.1

Moodle blind Server-Side Request Forgery (SSRF) vulnerability in LTI provider library

A blind Server-Side Request Forgery (SSRF) vulnerability was found in Moodle. This flaw exists due to insufficient validation of user-supplied input in LTI provider library. The library does not utilise Moodle's inbuilt cURL helper, which resulted in a blind SSRF risk. An attacker can send a specially crafted HTTP request and trick the application to initiate requests to arbitrary systems. This vulnerability allows a remote attacker to perform SSRF attacks.

Record
GHSA-xqcf-vgqc-pcmg
CVSS 3.1
9.1 CriticalCVSS:3.1/AV:N/AC:L/PR:N/UI:N/S:U/C:H/I:H/A:N
Weakness
CWE-918
Updated
2026-11-02
OSV 9.1

A blind Server-Side Request Forgery (SSRF) vulnerability was found in Moodle. This flaw exists due to insufficient validation of user-supplied input in LTI provider library. The library does not utilise Moodle's inbuilt cURL helper, which resulted in a blind SSRF risk. An attacker can send a specially crafted HTTP request and trick the application to initiate requests to arbitrary systems. This vulnerability allows a remote attacker to perform SSRF attacks.

Record
CVE-2022-45152
CVSS 3.1
9.1 CriticalCVSS:3.1/AV:N/AC:L/PR:N/UI:N/S:U/C:H/I:H/A:N
Weakness
CWE-918
Updated
2026-11-02
OSVGHSA-xqcf-vgqc-pcmg 9.1

Moodle blind Server-Side Request Forgery (SSRF) vulnerability in LTI provider library

A blind Server-Side Request Forgery (SSRF) vulnerability was found in Moodle. This flaw exists due to insufficient validation of user-supplied input in LTI provider library. The library does not utilise Moodle's inbuilt cURL helper, which resulted in a blind SSRF risk. An attacker can send a specially crafted HTTP request and trick the application to initiate requests to arbitrary systems. This vulnerability allows a remote attacker to perform SSRF attacks.

Record
GHSA-xqcf-vgqc-pcmg
CVSS 3.1
9.1 CriticalCVSS:3.1/AV:N/AC:L/PR:N/UI:N/S:U/C:H/I:H/A:N
Weakness
CWE-918
Updated
2026-11-02
OSVUBUNTU-CVE-2022-45152 9.1

A blind Server-Side Request Forgery (SSRF) vulnerability was found in Moodle. This flaw exists due to insufficient validation of user-supplied input in LTI provider library. The library does not utilise Moodle's inbuilt cURL helper, which resulted in a blind SSRF risk. An attacker can send a specially crafted HTTP request and trick the application to initiate requests to arbitrary systems. This vulnerability allows a remote attacker to perform SSRF attacks.

Record
UBUNTU-CVE-2022-45152
CVSS 3.1
9.1 CriticalCVSS:3.1/AV:N/AC:L/PR:N/UI:N/S:U/C:H/I:H/A:N
Updated
2026-11-02
OSVBIT-moodle-2022-45152 No score

A blind Server-Side Request Forgery (SSRF) vulnerability was found in Moodle. This flaw exists due to insufficient validation of user-supplied input in LTI provider library. The library does not utilise Moodle's inbuilt cURL helper, which resulted in a blind SSRF risk. An attacker can send a specially crafted HTTP request and trick the application to initiate requests to arbitrary systems. This vulnerability allows a remote attacker to perform SSRF attacks.

Record
BIT-moodle-2022-45152
Updated
2026-11-02

Affected products

Affected packages

Affected packages
PackageAffectedFixed
moodle/moodle
Packagist
 3.9 up to 3.9.18
3.9.18
moodle/moodle
Packagist
 3.11 up to 3.11.11
3.11.11
moodle/moodle
Packagist
 4.0 up to 4.0.5
4.0.5
moodle
Bitnami
 before 3.9.18, 3.11.0 up to 3.11.11, 4.0.0 up to 4.0.5
3.9.183.11.114.0.5
moodle/moodle
Packagist
 3.9 up to 3.9.18, plus listed versions
v3.9.0v3.9.0-betav3.9.0-rc1v3.9.0-rc2v3.9.0-rc3
Show 17 moreShow less
v3.9.1v3.9.10v3.9.11v3.9.12v3.9.13v3.9.14v3.9.15v3.9.16v3.9.17v3.9.2v3.9.3v3.9.4v3.9.5v3.9.6v3.9.7v3.9.8v3.9.9
3.9.18
moodle/moodle
Packagist
 3.11 up to 3.11.11, plus listed versions
v3.11.0v3.11.0-betav3.11.0-rc1v3.11.0-rc2v3.11.1
Show 9 moreShow less
v3.11.10v3.11.2v3.11.3v3.11.4v3.11.5v3.11.6v3.11.7v3.11.8v3.11.9
3.11.11
moodle/moodle
Packagist
 4.0 up to 4.0.5, plus listed versions
v4.0.0v4.0.0-betav4.0.0-rc1v4.0.0-rc2v4.0.0-rc3
Show 5 moreShow less
v4.0.0-rc4v4.0.1v4.0.2v4.0.3v4.0.4
4.0.5
moodle
Ubuntu:Pro:16.04:LTS
 All versions, plus listed versions
2.7.9+dfsg-12.7.10+dfsg-12.7.11+dfsg-12.7.11+dfsg-22.7.12+dfsg-13.0.3+dfsg-0ubuntu13.0.3+dfsg-0ubuntu1+esm1
 None known
moodle
Ubuntu:Pro:18.04:LTS
 All versions, plus listed versions
3.0.3+dfsg-0ubuntu13.0.3+dfsg-0ubuntu1+esm1
 None known

History

History
RecordedChangedSources
first indexedCVE List, EUVD, GitHub Advisories, NVD, OSV

Dates are when Every CVE recorded each change. Upstream dates may differ.

In short

CVE-2022-45152 is a critical vulnerability (CVSS 9.1) in Moodle, published November 25, 2022. No source lists public exploit code. EPSS puts the chance of exploitation in the next 30 days at 1.47%, the 73rd percentile. Fixed in moodle/moodle 3.9.18.

References

Show 9 moreShow less
Pages All vulnerabilities Browse Docs Sources Guide Get API key
MoveEnter Open