5.4 Medium
CVSS3
Attack Vector
NETWORK
Attack Complexity
LOW
Privileges Required
NONE
User Interaction
REQUIRED
Scope
UNCHANGED
Confidentiality Impact
LOW
Integrity Impact
LOW
Availability Impact
NONE
CVSS:3.1/AV:N/AC:L/PR:N/UI:R/S:U/C:L/I:L/A:N
0.002 Low
EPSS
Percentile
59.6%
A vulnerability was found in Moodle which exists due to insufficient
validation of the HTTP request origin in course redirect URL. A user’s CSRF
token was unnecessarily included in the URL when being redirected to a
course they have just restored. A remote attacker can trick the victim to
visit a specially crafted web page and perform arbitrary actions on behalf
of the victim on the vulnerable website. This flaw allows an attacker to
perform cross-site request forgery attacks.
git.moodle.org/gw?p=moodle.git&a=search&h=HEAD&st=commit&s=MDL-75862
bugzilla.redhat.com/show_bug.cgi?id=2142772
launchpad.net/bugs/cve/CVE-2022-45149
moodle.org/mod/forum/discuss.php?d=440769
nvd.nist.gov/vuln/detail/CVE-2022-45149
security-tracker.debian.org/tracker/CVE-2022-45149
www.cve.org/CVERecord?id=CVE-2022-45149