Vulnerability Bulletins |
MSA-25-0032: SSRF risk via DNS rebind |
|
| Affected software | PHP |
|
di Michael Hawkins. A DNS rebind risk in the way cURL requests were handled could result in an SSRF risk, due to the possibility of cURL blocked hosts / allowed ports site configurations being bypassed.Severity/Risk:SeriousVersions affected:5.0, 4.5 to 4.5.4, 4.4 to 4.4.8, 4.1 to 4.1.18 and earlier unsupported versionsVersions fixed:5.0.1, 4.5.5, 4.4.9 and 4.1.19Reported by:Rekter0 and Holme, 0x123456789, TaiYou, and Vladislav Gladkiy (Positive Technologies)CVE identifier:CVE-2025-49514Changes More info: https://moodle.org/mod/forum/discuss.php?d=468503&parent=1880834 |
|