Moodle edit_blog.php Server-Side Request Forgery Vulnerability [CVE-2019-6970]

CVE Number – CVE-2019-6970

A vulnerability in the edit_blog.php script of Moodle could allow an authenticated, remote attacker to perform a server-side request forgery (SSRF) attack on a targeted system.The vulnerability is due to an input validation flaw in the edit_blog.php script when GET requests are performed. An attacker could exploit this vulnerability by supplying crafted GET requests, including parameters, to the targeted system. A successful exploit could allow the attacker to conduct an SSRF attack and execute remote code on the targeted system.Moodle has not confirmed this vulnerability and updates are not available.

Analysis

• To conduct a successful exploit, the attacker must be a registered user and be able to construct specific GET requests. These requirements could reduce the likelihood of a successful attack.
  

Safeguards

• Administrators are advised to allow only trusted users to have network access.    
  Administrators are advised to run both firewall and antivirus applications to minimize the potential of inbound and outbound threats.    
  Administrators may consider using IP-based access control lists (ACLs) to allow only trusted systems to access the affected systems.    
  Administrators can help protect affected systems from external attacks by using a solid firewall strategy.

Vendor Announcements

• At the time this alert was first published, the vendor had not released a security notice.
  

Fixed Software

• At the time this alert was first published, the vendor had not released software updates.