CVE-2022-45152: Fedoraproject Extra Packages For Enterprise Linux

Critical severity, CVSS 9.1. EPSS: 1.4% chance of exploitation in the next 30 days.

A blind Server-Side Request Forgery (SSRF) vulnerability was found in Moodle. This flaw exists due to insufficient validation of user-supplied input in LTI provider library. The library does not utilise Moodle's inbuilt cURL helper, which resulted in a blind SSRF risk. An attacker can send a specially crafted HTTP request and trick the application to initiate requests to arbitrary systems. This vulnerability allows a remote attacker to perform SSRF attacks.

Affected products

• Fedoraproject Extra Packages For Enterprise Linux: version 7.0 only
• Fedoraproject Fedora: version 35 only; version 36 only; version 37 only
• Moodle Moodle: before 3.9.18 (fixed in 3.9.18); from 3.11.0, before 3.11.11 (fixed in 3.11.11); from 4.0.0, before 4.0.5 (fixed in 4.0.5)

Published 2022-11-25. Last modified 2026-06-17.