CVE-2018-1081: Moodle - Unauthenticated users can trigger custom messages to admin via paypal enrol script
Summary
CVE-2018-1081: Moodle Unauthenticated users can trigger custom messages to admin via paypal enrol script. Affects moodle/moodle across 4 version ranges.
>= 3.1, < 3.1.11
>= 3.2, < 3.2.8
>= 3.3, < 3.3.5
>= 3.4, < 3.4.2
Fixed in 4 releases; the minimum fixed version depends on the release line you run. How to fix ↓
Check if this vulnerability affects your application
Upload a manifest or SBOM and we'll show whether you're affected, plus every other risky package in the same scan.
No signup required · Results in about 60 seconds
Background
Moodle is an open-source learning management system (LMS) used by educational institutions to create and manage online courses. It provides a platform for educators to deliver content, interact with students, and assess their progress. Moodle is widely adopted and offers various features such as course management, user management, and communication tools. However, a vulnerability has been identified in Moodle versions 3.1 to 3.4.1, which allows unauthenticated users to trigger custom messages to the admin via the PayPal enrol script.
Vulnerability Detail
The vulnerability in Moodle allows unauthenticated users to exploit the PayPal IPN callback script, which is responsible for handling payment notifications. The script should only send error emails to the admin after verifying the request origin. However, due to a flaw, unauthenticated users can send custom messages to the admin, potentially leading to spamming the admin's email. This vulnerability can be exploited to disrupt the admin's workflow and cause inconvenience. The severity of this vulnerability is moderate, with a CVSS score of 5.3.
How To Fix
Fixed versions by release line
The minimum fixed version depends on the release line you run.
-
>= 3.1, < 3.1.113.1.11composer require moodle/moodle:3.1.11 -
>= 3.2, < 3.2.83.2.8composer require moodle/moodle:3.2.8 -
>= 3.3, < 3.3.53.3.5composer require moodle/moodle:3.3.5 -
>= 3.4, < 3.4.23.4.2composer require moodle/moodle:3.4.2
Tip — Not sure which release line you're on? Vulert can find the fix for the version you are using. Scan free →
Workaround
There is no specific workaround mentioned for this vulnerability. It is recommended to apply the patch or upgrade to the latest version of Moodle to mitigate the risk.
Conclusion
In conclusion, the identified vulnerability in Moodle allows unauthenticated users to trigger custom messages to the admin via the PayPal enrol script. This can lead to spamming the admin's email and disrupt their workflow. It is crucial to upgrade to the patched versions of Moodle or apply the recommended fixes to mitigate the risk. For further support on vulnerability remediation, please contact DevNack.com.
See every vulnerability recorded for moodle/moodle →
FAQ
Moodle is an open-source learning management system used by educational institutions to create and manage online courses.
The vulnerability allows unauthenticated users to send custom messages to the admin via the PayPal enrol script, potentially leading to spamming the admin's email.
The severity of this vulnerability is moderate, with a CVSS score of 5.3.
To fix this vulnerability, it is recommended to upgrade to the patched versions of Moodle.
There is no specific workaround mentioned for this vulnerability. It is recommended to apply the patch or upgrade to the latest version of Moodle.
Related vulnerabilities
Recent vulnerabilities recorded for moodle/moodle.
