GHSA-8v23-w4w5-w83c

Source

https://github.com/github/advisory-database/blob/main/advisories/github-reviewed/2022/11/GHSA-8v23-w4w5-w83c/GHSA-8v23-w4w5-w83c.json

Aliases

• CVE-2022-45149

Published

2022-11-23T15:30:21Z

Modified

2023-04-11T01:49:32.489961Z

Details

A vulnerability was found in Moodle which exists due to insufficient validation of the HTTP request origin in course redirect URL. A user's CSRF token was unnecessarily included in the URL when being redirected to a course they have just restored. A remote attacker can trick the victim to visit a specially crafted web page and perform arbitrary actions on behalf of the victim on the vulnerable website. This flaw allows an attacker to perform cross-site request forgery attacks.

References

• https://nvd.nist.gov/vuln/detail/CVE-2022-45149
• https://bugzilla.redhat.com/show_bug.cgi?id=2142772
• https://lists.fedoraproject.org/archives/list/package-announce@lists.fedoraproject.org/message/2DHYIIAUXUBHMBEDYU7TYNZXEN2W2SA2/
• https://lists.fedoraproject.org/archives/list/package-announce@lists.fedoraproject.org/message/74SXNGA5RIWM7QNX7H3G7SYIQLP4UUGV/
• https://lists.fedoraproject.org/archives/list/package-announce@lists.fedoraproject.org/message/NLRJB5JNKK3VVBLV3NH3RI7COEDAXSAB/
• https://moodle.org/mod/forum/discuss.php?d=440769
• http://git.moodle.org/gw?p=moodle.git&a=search&h=HEAD&st=commit&s=MDL-75862