Description
A flaw was found in Moodle versions 3.1 to 3.1.15 and earlier unsupported versions. The mybackpack functionality allowed setting the URL of badges, when it should be restricted to the Mozilla Open Badges backpack URL. This resulted in the possibility of blind SSRF via requests made by the page.
Affected products
| Vendor | Product | Affected | Fixed |
|---|---|---|---|
| [UNKNOWN] | moodle | 3.1.16 | — |
Fixed in Linux distributions
Distributions backport fixes, so the version that fixes this vulnerability differs per release — upgrade to at least the version shown. From the distributions' security trackers and advisories.
Ubuntu
Security tracker ↗| Release | Package | Fixed in | Advisory |
|---|---|---|---|
| Ubuntu Pro 18.04 LTS | moodle | 3.0.3+dfsg-0ubuntu1+esm1 | USN-8805-1 |
| Ubuntu Pro 16.04 LTS | moodle | 3.0.3+dfsg-0ubuntu1+esm1 | USN-8805-1 |
Affected packages
| Ecosystem | Package | Affected | Fixed | Record |
|---|---|---|---|---|
| Packagist | moodle/moodle | >= 3.1, < 3.1.16 | 3.1.16 | GHSA-jp4g-r8c9-3534 |
Advisories 1
- USN-8805-1 moodle vulnerability Ubuntu Security Notices (USN) · Sep 24, 2026