CVE-2018-1081CWE-79

A flaw was found in Moodle 3.4 to 3.4.1, 3.3 to 3.3.4, 3.2 to 3.2.7, 3.1 to 3.1.10 and earlier unsupported versions

published April 4, 2018

CVSS
—
EPSS
1%
Percentile
72.4
In the wild
Unconfirmed
What it is

A flaw was found in Moodle 3.4 to 3.4.1, 3.3 to 3.3.4, 3.2 to 3.2.7, 3.1 to 3.1.10 and earlier unsupported versions. Unauthenticated users can trigger custom messages to admin via paypal enrol script. Paypal IPN callback script should only send error emails to admin after request origin was verified, otherwise admin email can be spammed.

The record
Technical detail
CVSS
Not scored
CVSS v4.0
Not supplied
EPSS
0.01408 · 72.4th percentile
Weakness
CWE-79 · Improper Neutralization of Input During Web Page Generation ('Cross-site Scripting')
Published
2018-04-04T21:00Z
EPSS history
Timeline
  • 04 APR 21:00Z
    A flaw was found in Moodle 3.4 to 3.4.1, 3.3 to 3.3.4, 3.2 to 3.2.7, 3.1 to 3.1.10 and earlier unsupported versions
    cvelistv5