CVE-2021-36402: Moodle - Account Confirmation Email Phishing Risk
Summary
CVE-2021-36402: In Moodle, Users' names required additional sanitizing in the account confirmation email, to prevent a self-registration phishing risk. Affects moodle across 3 version ranges.
< 3.9.8
>= 3.10.0, < 3.10.5
>= 3.11.0, < 3.11.1
Fixed in 3.9.8, 3.10.5 or 3.11.1, depending on the release line you run. How to fix ↓
Also tracked for
- moodle/moodle · Packagist
The same CVE-2021-36402 is tracked separately for each ecosystem and vendor. Its fix information is the same; the package and affected versions differ.
Check if this vulnerability affects your application
Upload a manifest or SBOM and we'll show whether you're affected, plus every other risky package in the same scan.
No signup required · Results in about 60 seconds
Background
Moodle is an open-source learning management system widely used for online education. It provides a platform for educators to create and deliver courses, manage student enrollment, and facilitate communication and collaboration. Moodle is known for its flexibility, extensibility, and user-friendly interface. However, a vulnerability has been identified in Moodle that exposes users to a phishing risk through the account confirmation email.
Vulnerability Detail
The vulnerability in Moodle arises from inadequate sanitization of users' names in the account confirmation email. This oversight opens up the possibility of self-registration phishing attacks. Attackers can exploit this vulnerability by crafting malicious account confirmation emails that appear legitimate, tricking users into revealing sensitive information or performing unintended actions. The impact of this vulnerability can range from compromised user accounts to unauthorized access to the Moodle system.
How To Fix
Fixed versions by release line
The minimum fixed version depends on the release line you run.
-
< 3.9.83.9.8 -
>= 3.10.0, < 3.10.53.10.5 -
>= 3.11.0, < 3.11.13.11.1
Tip — Not sure which release line you're on? Vulert can find the fix for the version you are using. Scan free →
Workaround
No workaround has been provided for this vulnerability. It is essential to apply the available updates to address the issue effectively.
Conclusion
The vulnerability in Moodle that allows self-registration phishing attacks through the account confirmation email can have severe consequences for users and the Moodle system. It is crucial for administrators to promptly update their Moodle installation to the recommended versions to mitigate this risk. For further support on vulnerability remediation, you can reach out to DevNack.com.
See every vulnerability recorded for moodle →
FAQ
Moodle is an open-source learning management system used for online education. It provides a platform for educators to create and deliver courses, manage student enrollment, and facilitate communication and collaboration.
The vulnerability exposes users to a phishing risk through the account confirmation email. Attackers can exploit this to trick users into revealing sensitive information or performing unintended actions, potentially compromising user accounts or gaining unauthorized access to the Moodle system.
To fix this vulnerability, update Moodle to version 3.9.8, 3.10.5, or 3.11.1, depending on the installed version. These updates include the necessary sanitization measures to prevent self-registration phishing attacks.
No workaround has been provided for this vulnerability. It is crucial to apply the available updates to address the issue effectively.
For more information about this vulnerability, you can refer to the official Moodle documentation or contact the Moodle support team.
References
Related vulnerabilities
Recent vulnerabilities recorded for moodle.
