moodle: CSRF risks due to misuse of confirm_sesskey

Affected versions

NVD version ranges (for catalog products). Add the product to your stack with a version and matching uses these.

• fedoraproject fedora39
• fedoraproject fedora40
• moodle moodlebefore 4.1.10
• moodle moodle4.2.0 and later · before 4.2.8
• moodle moodle4.3.0 and later · before 4.3.5
• moodle moodle4.4.0

Versions reported by the vendor

Affected version ranges reported by the assigning authority (fedora). Independent of NVD's CPE analysis and usually ahead of it.

• Moodle Moodle

  • 4.4affected
  • 4.3 and later · up to and including 4.3.4affected · semver
  • 4.2 and later · up to and including 4.2.7affected · semver
  • 4.1 and later · up to and including 4.1.10affected · semver

Package-level exposure

OSV and GitHub Advisory data: ecosystem, package and range. SBOM matching uses this table.

Other highest-scoring records for the same primary product.

• CVE-2018-1111DHCP packages in Red Hat Enterprise Linux 6 and 7, Fedora 28, and earlier are vulnerable to a command injection flaw in the NetworkManager i
  59Plan
• CVE-2024-24576Rusts's `std::process::Command` did not properly escape arguments of batch files on Windows
  46Plan
• CVE-2016-7167Multiple integer overflows in the (1) curl_escape, (2) curl_easy_escape, (3) curl_unescape, and (4) curl_easy_unescape functions in libcurl
  43Plan
• CVE-2016-2173org.springframework.core.serializer.DefaultDeserializer in Spring AMQP before 1.5.5 allows remote attackers to execute arbitrary code.
  41Plan
• CVE-2015-0278libuv before 0.10.34 does not properly drop group privileges, which allows context-dependent attackers to gain privileges via unspecified ve
  41Plan
• CVE-2015-3145The sanitize_cookie_path function in cURL and libcurl 7.31.0 through 7.41.0 does not properly calculate an index, which allows remote attack
  41Plan

FIRST EPSS daily score; only changes of 0.01 or more are recorded (step chart).

Root cause

State-changing requests rely on the session cookie the browser sends automatically; nothing verifies that the request came from the user’s own page.

A representative example of this vulnerability class. Not the vendor's source code; it shows the faulty pattern and its fix.

1app.use(session({ cookie: { httpOnly: true } }));2app.post("/account/address", updateAddress);

1app.use(session({ cookie: { httpOnly: true, sameSite: "lax" } }));2app.post("/account/address", csrfProtection, updateAddress);

Attack context

MITRE CAPEC attack patterns and ATT&CK techniques for this weakness class (CWE). A starting point for detection rules and threat hunting.