Vulnerability Bulletins

MSA-23-0018: SSRF risk due to insufficient check on the cURL blocked hosts list


System information

   
Affected software PHP

Description

par Michael Hawkins. An issue in the logic used to check 0.0.0.0 against the cURL blocked hosts lists resulted in an SSRF risk.Severity/Risk:SeriousVersions affected:4.2, 4.1 to 4.1.3, 4.0 to 4.0.8, 3.11 to 3.11.14, 3.9 to 3.9.21 and earlier unsupported versionsVersions fixed:4.2.1, 4.1.4, 4.0.9, 3.11.15 and 3.9.22Reported by:Mateo HanžekCVE identifier:CVE-2023-35133Changes (master):http://git.moodle.org/gw?p=moodle.git&a=search&h=HEAD&st=commit&s=MDL-78215Tracker

More info:

https://moodle.org/mod/forum/discuss.php?d=447831&parent=1799656

Standar resources

Property Value
CVE CVE-2023-35133.

Version history

Version Comments Date
1.0 Advisory issued 2023-06-22
Ministerio de Defensa
Presidencia española. Consejo de la Unión Europea
CNI
CCN
CCN-CERT