Blind SSRF Vulnerability in Moodle LTI Provider Library

CVE-2022-45152

What is CVE-2022-45152?

A blind Server-Side Request Forgery (SSRF) vulnerability exists in Moodle's LTI provider library due to inadequate validation of user-supplied input. The library bypasses Moodle's built-in cURL helper, leading to potential exploitation. An attacker could craft specific HTTP requests, tricking the application into issuing requests to arbitrary systems, thereby allowing unauthorized access or manipulation of resources without detection.

References