Blind SSRF Risk Due to Insufficient Redirect Handling in Moodle

CVE-2021-36396

What is CVE-2021-36396?

In Moodle, an oversight in the handling of redirects allows for exploitation through Server-Side Request Forgery (SSRF) attacks. This vulnerability enables attackers to bypass cURL's blocked hosts and allowed ports, facilitating unauthorized requests from the server to internal services or other external systems. The improper validation of redirects can result in severe security implications, necessitating immediate attention and remediation by system administrators.

References