PT-2012-2873 · Moodle+1 · Moodle+1

Vincent Danen · Published 2012-07-17 · Updated 2023-02-13 · CVE-2012-0796

Positive Technologies (AI Summary)

CVSS v2.0

4.0

Medium

Base vector

AV:N/AC:L/Au:S/C:N/I:P/A:N

Name of the Vulnerable Software and Affected Versions Moodle versions 1.9.x through 1.9.15 Moodle versions 2.0.x through 2.0.6 Moodle versions 2.1.x through 2.1.3 Moodle versions 2.2.x through 2.2.0

Description The issue allows remote authenticated users to inject arbitrary e-mail headers via crafted From: or Sender: headers. This can be achieved by manipulating the From: or Sender: header in the class.phpmailer.php file of the PHPMailer library. Arbitrary additional email headers can be injected via these crafted headers.

Recommendations For Moodle versions 1.9.x through 1.9.15, update to version 1.9.16 or later. For Moodle versions 2.0.x through 2.0.6, update to version 2.0.7 or later. For Moodle versions 2.1.x through 2.1.3, update to version 2.1.4 or later. For Moodle versions 2.2.x through 2.2.0, update to version 2.2.1 or later. As a temporary workaround, filter user-supplied values prior to using them in From or Sender properties.

Fix

Code Injection

Weakness Enumeration

CWE-94

Related Identifiers

CVE-2012-0796

DSA-2421-1

GHSA-398J-F7M7-795J

Affected Products

Moodle

Phpmailer

References · 9

• http://moodle.org/mod/forum/discuss.php?d=194015 · Vendor Advisory
• https://nvd.nist.gov/vuln/detail/CVE-2012-0796 · Security Note
• https://osv.dev/vulnerability/GHSA-398j-f7m7-795j · Vendor Advisory
• http://debian.org/security/2012/dsa-2421 · Vendor Advisory
• https://github.com/PHPMailer/PHPMailer · Note
• https://github.com/PHPMailer/PHPMailer/security/advisories/GHSA-398j-f7m7-795j · Note
• https://bugzilla.redhat.com/show_bug.cgi?id=783532 · Note
• https://git.moodle.org/gw?p=moodle.git&a=commit&h=62988bf0bbc73df655f51884aaf1f523928abff9 · Note
• http://git.moodle.org/gw?p=moodle.git%3Ba=commit%3Bh=62988bf0bbc73df655f51884aaf1f523928abff9 · Note