CVE-2022-45149: Cross-Site Request Forgery (CSRF)

November 23, 2022 (updated November 7, 2023)

A vulnerability was found in Moodle which exists due to insufficient validation of the HTTP request origin in course redirect URL. A user’s CSRF token was unnecessarily included in the URL when being redirected to a course they have just restored. A remote attacker can trick the victim to visit a specially crafted web page and perform arbitrary actions on behalf of the victim on the vulnerable website. This flaw allows an attacker to perform cross-site request forgery attacks.

References

git.moodle.org/gw?p=moodle.git&a=search&h=HEAD&st=commit&s=MDL-75862
bugzilla.redhat.com/show_bug.cgi?id=2142772
github.com/advisories/GHSA-8v23-w4w5-w83c
moodle.org/mod/forum/discuss.php?d=440769
nvd.nist.gov/vuln/detail/CVE-2022-45149

Code Behaviors & Features

Detect and mitigate CVE-2022-45149 with GitLab Dependency Scanning

Secure your software supply chain by verifying that all open source dependencies used in your projects contain no disclosed vulnerabilities. Dependency Scanning using SBOM also detects vulnerabilities from proprietary advisories that this site does not include. Learn more about Dependency Scanning using SBOM →