CVE-2022-45149

moodle, fedoraproject fedora

TLP:CLEAR

csirt@kutim:~/threat-intel/cve/CVE-2022-45149

Katalog CVE

CVSS 5.4 · Medium EPSS 0,43%

Kerentanan Cross-Site Request Forgery (CSRF) pada moodle, fedoraproject fedora. Skor CVSS 3.1 5.4 (Medium) menurut NVD.

Deskripsi (NVD)

A vulnerability was found in Moodle which exists due to insufficient validation of the HTTP request origin in course redirect URL. A user's CSRF token was unnecessarily included in the URL when being redirected to a course they have just restored. A remote attacker can trick the victim to visit a specially crafted web page and perform arbitrary actions on behalf of the victim on the vulnerable website. This flaw allows an attacker to perform cross-site request forgery attacks.

Rincian

Terbit di NVD
23 November 2022
Terakhir diubah
17 Juni 2026
Status NVD
Modified
CVSS 3.1
5.4 (Medium), sumber NVD
CVSS:3.1/AV:N/AC:L/PR:N/UI:R/S:U/C:L/I:L/A:N · uraikan di kalkulator
Jenis kelemahan (CWE)
CWE-352: Cross-Site Request Forgery (CSRF)
EPSS (30 hari)
0,43% peluang dieksploitasi; lebih tinggi dari 35,0% CVE lain

Produk dan versi terdampak

VendorProdukVersi terdampak
moodle moodle Versi 3.9.0 hingga sebelum 3.9.18
moodle moodle Versi 3.11.0 hingga sebelum 3.11.11
moodle moodle Versi 4.0.0 hingga sebelum 4.0.5
fedoraproject fedora Versi 35
fedoraproject fedora Versi 36
fedoraproject fedora Versi 37

> Data dari konfigurasi CPE di NVD.

Referensi dan perbaikan

Sumber: NVD · CVE.org · EPSS. Halaman ini disusun otomatis dari data tersebut; pembaruan terakhir 5 Okt 2026, 20:10 WITA. Kalau sistem di Perangkat Daerah memakai produk ini dan butuh bantuan, laporkan lewat kanal pelaporan.