CVE-2018-1081

5.3MEDIUM

Key Information:

Vendor
Red Hat
Status
Moodle
Vendor
CVE Published:
4 April 2018

Summary

A flaw was found in Moodle 3.4 to 3.4.1, 3.3 to 3.3.4, 3.2 to 3.2.7, 3.1 to 3.1.10 and earlier unsupported versions. Unauthenticated users can trigger custom messages to admin via paypal enrol script. Paypal IPN callback script should only send error emails to admin after request origin was verified, otherwise admin email can be spammed.

Affected Version(s)

Moodle 3.4 to 3.4.1, 3.3 to 3.3.4, 3.2 to 3.2.7, 3.1 to 3.1.10 and earlier unsupported versions

References

https://git.moodle.org/gw?p=moodle.git&a=search&h=HEAD&st...
x_refsource_CONFIRM
https://moodle.org/mod/forum/discuss.php?d=367938
x_refsource_CONFIRM
http://www.securityfocus.com/bid/103728
vdb-entryx_refsource_BID

CVSS V3.1

Score:
5.3
Severity:
MEDIUM
Confidentiality:
None
Integrity:
Low
Availability:
None
Attack Vector:
Network
Attack Complexity:
Low
Privileges Required:
None
User Interaction:
None
Scope:
Unchanged

Timeline

  • Vulnerability published

  • Vulnerability Reserved

.