A flaw was found in Moodle 3.4 to 3.4.1, 3.3 to 3.3.4, 3.2 to 3.2.7, 3.1 to 3.1.10 and earlier unsupported versions. Unauthenticated users can trigger custom messages to admin via paypal enrol script. Paypal IPN callback script should only send error emails to admin after request origin was verified, otherwise admin email can be spammed.

The Linux/Unix host has one or more packages installed that are impacted by a vulnerability without a vendor supplied patch available.

  - A flaw was found in Moodle 3.4 to 3.4.1, 3.3 to 3.3.4, 3.2 to 3.2.7, 3.1 to 3.1.10 and earlier unsupported     versions. Unauthenticated users can trigger custom messages to admin via paypal enrol script. Paypal IPN     callback script should only send error emails to admin after request origin was verified, otherwise admin     email can be spammed. (CVE-2018-1081)

Note that Nessus relies on the presence of the package as reported by the vendor.

There are packages installed that are affected by a vulnerability referenced in the following CVE:

  - A flaw was found in Moodle 3.4 to 3.4.1, 3.3 to 3.3.4, 3.2 to 3.2.7, 3.1 to 3.1.10 and earlier unsupported
    versions. Unauthenticated users can trigger custom messages to admin via paypal enrol script. Paypal IPN
    callback script should only send error emails to admin after request origin was verified, otherwise admin
    email can be spammed. (CVE-2018-1081)

moodle reports :

Unauthenticated users can trigger custom messages to admin via paypal enrol script.

Suspended users with OAuth 2 authentication method can still log in to the site.

ID	Name	Product	Family	Type	Severity
263382	Linux Distros Unpatched Vulnerability : CVE-2018-1081	Nessus	Misc.	Local	medium
433994	SCA: security update for moodle/moodle (GHSA-v9xq-vh72-chr4)	Tenable Cloud Security	SCA Checks	Local	medium
433994	SCA: security update for moodle/moodle (GHSA-v9xq-vh72-chr4)	Tenable Self-Hosted Container Security	SCA Checks	Local	medium
108781	FreeBSD : moodle -- multiple vulnerabilities (cdb4d962-34f9-11e8-92db-080027907385)	Nessus	FreeBSD Local Security Checks	Local	high

Detections

Analytics

CVE-2018-1081

medium

Tenable Plugins

medium

medium

medium

high