CVE-2018-1081

State: Published
Severity: Not scored
Published: Apr 4, 2018
Updated: Sep 16, 2024
Reserved: Dec 4, 2017

Description

A flaw was found in Moodle 3.4 to 3.4.1, 3.3 to 3.3.4, 3.2 to 3.2.7, 3.1 to 3.1.10 and earlier unsupported versions. Unauthenticated users can trigger custom messages to admin via paypal enrol script. Paypal IPN callback script should only send error emails to admin after request origin was verified, otherwise admin email can be spammed.

Scores

The record has no CVSS score.

Weaknesses

CWE-79

Affected Products

Product	Versions
MoodleRed Hat, Inc.	3.4 to 3.4.1, 3.3 to 3.3.4, 3.2 to 3.2.7, 3.1 to 3.1.10 and earlier unsupported versionsAffected

References

https://git.moodle.org/gw?p=moodle.git&a=search&h=HEAD&st=commit&s=MDL-61392
https://moodle.org/mod/forum/discuss.php?d=367938
103728vdb-entry

Every record here comes from the CVE Program’s CVE List. © 1999–2026 The MITRE Corporation. CVE is a registered trademark of The MITRE Corporation. The records are reproduced under the CVE Program terms of use.