CVE-2021-36403: Moodle - Hidden Link Phishing Risk
Summary
CVE-2021-36403: In Moodle, in some circumstances, email notifications of messages could have the link back to the original message hidden by HTML, which may pose a phishing risk. Affects moodle across 3 version ranges.
< 3.9.8
>= 3.10.0, < 3.10.5
>= 3.11.0, < 3.11.1
Fixed in 3.9.8, 3.10.5 or 3.11.1, depending on the release line you run. How to fix ↓
Also tracked for
- moodle/moodle · Packagist
The same CVE-2021-36403 is tracked separately for each ecosystem and vendor. Its fix information is the same; the package and affected versions differ.
Check if this vulnerability affects your application
Upload a manifest or SBOM and we'll show whether you're affected, plus every other risky package in the same scan.
No signup required · Results in about 60 seconds
Background
Moodle is an open-source learning management system widely used for creating and managing online courses. It provides various features for educators and learners, including messaging functionality. However, in certain scenarios, Moodle's email notifications of messages may contain hidden HTML that obscures the link back to the original message. This hidden link poses a potential phishing risk, as users may be tricked into clicking on malicious links disguised as legitimate messages.
Vulnerability Detail
The vulnerability (CVE-2021-36403) in Moodle arises from the presence of HTML code that hides the link to the original message in email notifications. This can deceive users and expose them to phishing attacks. Attackers could exploit this vulnerability to trick users into clicking on malicious links, leading to potential data breaches, account compromises, or the installation of malware. The severity of this vulnerability is rated as Medium with a CVSSv3 score of 5.3 (AV:N/AC:L/PR:N/UI:N/S:U/C:N/I:L/A:N).
How To Fix
Fixed versions by release line
The minimum fixed version depends on the release line you run.
-
< 3.9.83.9.8 -
>= 3.10.0, < 3.10.53.10.5 -
>= 3.11.0, < 3.11.13.11.1
Tip — Not sure which release line you're on? Vulert can find the fix for the version you are using. Scan free →
Conclusion
In conclusion, the vulnerability (CVE-2021-36403) in Moodle allows for the hiding of links in email notifications, posing a potential phishing risk. It is crucial to update Moodle to the recommended versions (3.9.8, 3.10.5, or 3.11.1) to address this issue and ensure the correct display of links. For further support on vulnerability remediation, please contact DevNack.com.
See every vulnerability recorded for moodle →
FAQ
Moodle is an open-source learning management system used for creating and managing online courses. It provides a range of features for educators and learners.
The vulnerability in Moodle allows for the hiding of links in email notifications, potentially leading to phishing attacks and the compromise of user accounts or systems.
To fix this vulnerability, update Moodle to the recommended versions (3.9.8, 3.10.5, or 3.11.1) that address the issue and ensure correct display of links in email notifications.
No specific workarounds have been provided for this vulnerability. It is recommended to apply the available updates to mitigate the risk.
The severity of this vulnerability is rated as Medium with a CVSSv3 score of 5.3 (AV:N/AC:L/PR:N/UI:N/S:U/C:N/I:L/A:N).
References
Related vulnerabilities
Recent vulnerabilities recorded for moodle.
