PT-2018-10119 · Moodle · Moodle

Brendan Cox · Published 2018-04-04 · Updated 2022-05-13 · CVE-2018-1081

Positive Technologies (AI Summary)

CVSS v3.1

5.3

Medium

Base vector

AV:N/AC:L/PR:N/UI:N/S:U/C:N/I:L/A:N

Name of the Vulnerable Software and Affected Versions Moodle versions 3.1 through 3.1.10 Moodle versions 3.2 through 3.2.7 Moodle versions 3.3 through 3.3.4 Moodle versions 3.4 through 3.4.1

Description A flaw was found that allows unauthenticated users to trigger custom messages to admins via the paypal enrol script. The paypal IPN callback script fails to verify the request origin before sending error emails to admins, which can lead to admin email spamming.

Recommendations For Moodle versions 3.1 through 3.1.10, update the paypal IPN callback script to verify the request origin before sending error emails to admins. For Moodle versions 3.2 through 3.2.7, update the paypal IPN callback script to verify the request origin before sending error emails to admins. For Moodle versions 3.3 through 3.3.4, update the paypal IPN callback script to verify the request origin before sending error emails to admins. For Moodle versions 3.4 through 3.4.1, update the paypal IPN callback script to verify the request origin before sending error emails to admins.

Fix

XSS

Weakness Enumeration

CWE-79

Related Identifiers

CVE-2018-1081

GHSA-V9XQ-VH72-CHR4

Affected Products

Moodle

References · 11

• https://nvd.nist.gov/vuln/detail/CVE-2018-1081 · Security Note
• https://moodle.org/mod/forum/discuss.php?d=367938 · Vendor Advisory
• https://ubuntu.com/security/CVE-2018-1081 · Vendor Advisory
• https://osv.dev/vulnerability/GHSA-v9xq-vh72-chr4 · Vendor Advisory
• https://git.moodle.org/gw?p=moodle.git&a=search&h=HEAD&st=commit&s=MDL-61392 · Vendor Advisory
• https://osv.dev/vulnerability/UBUNTU-CVE-2018-1081 · Vendor Advisory
• https://cve.org/CVERecord?id=CVE-2018-1081 · Security Note
• https://osv.dev/vulnerability/CVE-2018-1081 · Vendor Advisory
• https://github.com/moodle/moodle · Note
• http://securityfocus.com/bid/103728 · Note
• https://git.moodle.org/gw?p=moodle.git&a=search&h=HEAD&st=commit&s=MDL-61392, · Note