A flaw was found in Moodle 3.4 to 3.4.1, and 3.3 to 3.3.4. If a user account using OAuth2 authentication method was once confirmed but later suspended, the user could still login to the site.

The Linux/Unix host has one or more packages installed that are impacted by a vulnerability without a vendor supplied patch available.

  - A flaw was found in Moodle 3.4 to 3.4.1, and 3.3 to 3.3.4. If a user account using OAuth2 authentication     method was once confirmed but later suspended, the user could still login to the site. (CVE-2018-1082)

Note that Nessus relies on the presence of the package as reported by the vendor.

There are packages installed that are affected by a vulnerability referenced in the following CVE:

  - A flaw was found in Moodle 3.4 to 3.4.1, and 3.3 to 3.3.4. If a user account using OAuth2 authentication
    method was once confirmed but later suspended, the user could still login to the site. (CVE-2018-1082)

moodle reports :

Unauthenticated users can trigger custom messages to admin via paypal enrol script.

Suspended users with OAuth 2 authentication method can still log in to the site.

ID	Name	Product	Family	Severity
263452	Linux Distros Unpatched Vulnerability : CVE-2018-1082	Nessus	Misc.	high
433670	SCA: security update for moodle/moodle (GHSA-qh8m-6g4p-33h3)	Tenable Cloud Security	SCA Checks	high
433670	SCA: security update for moodle/moodle (GHSA-qh8m-6g4p-33h3)	Tenable Self-Hosted Container Security	SCA Checks	high
108781	FreeBSD : moodle -- multiple vulnerabilities (cdb4d962-34f9-11e8-92db-080027907385)	Nessus	FreeBSD Local Security Checks	high

Detections

Analytics

CVE-2018-1082

high

Tenable Plugins

high

high

high

high