MSA-26-0027: Blind SSRF risk in MNet peers function

Kurzinfo

Metadaten

  • Original (extern): Link oeffnen
  • Veroeffentlicht: 2026-06-22 15:42 UTC
  • Importiert: 2026-06-29 14:51 UTC
  • Quelle-ID: moodle
  • uid_hash: 655591cb33f02cf2f1c75bc9de6f257ce337ded080eb65d324b74781304baa65
Moodle Security Announcements

Inhalt

by Michael Hawkins.

A blind SSRF risk was identified in the MNet peers management functionality, due to missing validation of peer hostnames against the cURL blocked hosts configuration. Note: This feature is only available to site administrators.

Severity/Risk: Minor

Versions affected: 5.2, 5.1 to 5.1.4, 5.0 to 5.0.7, 4.5 to 4.5.11 and earlier unsupported versions

Versions fixed: 5.2.1, 5.1.5, 5.0.8 and 4.5.12

Reported by: DangKhai (VPBank Security Team)

CVE identifier: Pending (this will be updated once available)

Changes (main): http://git.moodle.org/gw?p=moodle.git&a=search&h=HEAD&st=commit&s=MDL-87911

Tracker issue: MDL-87911 Blind SSRF risk in MNet peers function

No data

Quellen-Details

Bezeichnung Name Kategorie Tags Zielgruppe Sprache Feed-URL
Moodle Security Announcements

moodle

 vendor_advisory cms - de https://moodle.org/rss/file.php/154821/7ef1adaa0762dfdd7cd390868b6d9f2b/mod_forum/996/rss.xml
Zurueck zur Eintrags-Liste