CVE-2018-1081
Last modified
CVE-2018-1081 is a medium-severity vulnerability rated 5.3/10 on the CVSS scale. A flaw was found in Moodle 3.4 to 3.4.1, 3.3 to 3.3.4, 3.2 to 3.2.7, 3.1 to 3.1.10 and earlier unsupported versions. Unauthenticated users can trigger custom messages to admin via paypal enrol script. EPSS estimates a 1.47% chance of exploitation in the next 30 days.
Description
A flaw was found in Moodle 3.4 to 3.4.1, 3.3 to 3.3.4, 3.2 to 3.2.7, 3.1 to 3.1.10 and earlier unsupported versions. Unauthenticated users can trigger custom messages to admin via paypal enrol script. Paypal IPN callback script should only send error emails to admin after request origin was verified, otherwise admin email can be spammed.
Metrics
CVSS:3.1/AV:N/AC:L/PR:N/UI:N/S:U/C:N/I:L/A:N
Weakness Enumeration
Affected Software
| Vendor | Product | Versions |
|---|---|---|
| Moodle | Moodle | <= 3.0.10 |
| Moodle | Moodle | >= 3.1, <= 3.1.10 |
| Moodle | Moodle | >= 3.2, <= 3.2.7 |
| Moodle | Moodle | >= 3.3, <= 3.3.4 |
| Moodle | Moodle | >= 3.4.0, <= 3.4.1 |
References
- http://www.securityfocus.com/bid/103728Third Party Advisory, VDB Entry
- https://git.moodle.org/gw?p=moodle.git&a=search&h=HEAD&st=commit&s=MDL-61392Patch, Vendor Advisory
- https://moodle.org/mod/forum/discuss.php?d=367938Vendor Advisory
- http://www.securityfocus.com/bid/103728Third Party Advisory, VDB Entry
- https://git.moodle.org/gw?p=moodle.git&a=search&h=HEAD&st=commit&s=MDL-61392Patch, Vendor Advisory
- https://moodle.org/mod/forum/discuss.php?d=367938Vendor Advisory
Timeline
- Published
- Last Modified
- Status
- Modified
Frequently Asked Questions
What is CVE-2018-1081?
How severe is CVE-2018-1081?
How do I fix CVE-2018-1081?
How Strix Helps
- How Strix found a critical auth bypass in etcdStrix autonomously discovered a critical authentication bypass in etcd, later designated CVE-2026-33413.
- Autonomous PentestingAI agents that find and validate exploitable vulnerabilities like this one across your applications.
- PR ReviewsPentest every pull request so vulnerable code is caught before it ships to production.
- AI Penetration TestingHow AI-driven penetration testing continuously covers your attack surface.
Related CVEs from 2018
- CVE-2018-10801TIFFClientOpen in tif_unix.c in LibTIFF 3.8.2 has memory lea…
- CVE-2018-10803Cross-site scripting (XSS) vulnerability in the add credenti…
- CVE-2018-10804ImageMagick version 7.0.7-28 contains a memory leak in Write…
- CVE-2018-10805ImageMagick version 7.0.7-28 contains a memory leak in ReadY…
- CVE-2018-10806An issue was discovered in Frog CMS 0.9.5. There is a reflec…
- CVE-2018-10809In 2345 Security Guard 3.7, the driver file (2345NetFirewall…
- CVE-2018-10810chat/mobile/index.php in LiveZilla Live Chat 7.0.9.5 and pri…
- CVE-2018-10811strongSwan 5.6.0 and older allows Remote Denial of Service b…7.5
- CVE-2018-10812The Bitpie application through 3.2.4 for Android and iOS use…
- CVE-2018-10813In Dedos-web 1.0, the cookie and session secrets used in the…
- CVE-2018-10814Synametrics SynaMan 4.0 build 1488 uses cleartext password s…
- CVE-2018-10815An issue was discovered in Cloudera Manager before 5.13.4, 5…
Are you affected by CVE-2018-1081?
Run a free Strix scan to check your systems for this vulnerability.
Scan your code nowSource: NVD / NIST