Description
A flaw was found in Moodle 3.4 to 3.4.1, 3.3 to 3.3.4, 3.2 to 3.2.7, 3.1 to 3.1.10 and earlier unsupported versions. Unauthenticated users can trigger custom messages to admin via paypal enrol script. Paypal IPN callback script should only send error emails to admin after request origin was verified, otherwise admin email can be spammed.
Affected products
| Vendor | Product | Affected | Fixed |
|---|---|---|---|
| Red Hat | Moodle | 3.4 to 3.4.1, 3.3 to 3.3.4, 3.2 to 3.2.7, 3.1 to 3.1.10 and earlier unsupported versions | — |
Fixed in Linux distributions
Distributions backport fixes, so the version that fixes this vulnerability differs per release — upgrade to at least the version shown. From the distributions' security trackers and advisories.
Ubuntu
Security tracker ↗| Release | Package | Fixed in | Advisory |
|---|---|---|---|
| Ubuntu Pro 18.04 LTS | moodle | No fix yet | — |
| Ubuntu Pro 16.04 LTS | moodle | No fix yet | — |
Affected packages
| Ecosystem | Package | Affected | Fixed | Record |
|---|---|---|---|---|
| Packagist | moodle/moodle | >= 3.1, < 3.1.11 | 3.1.11 | GHSA-v9xq-vh72-chr4 |
| Packagist | moodle/moodle | >= 3.2, < 3.2.8 | 3.2.8 | GHSA-v9xq-vh72-chr4 |
| Packagist | moodle/moodle | >= 3.3, < 3.3.5 | 3.3.5 | GHSA-v9xq-vh72-chr4 |
| Packagist | moodle/moodle | >= 3.4, < 3.4.2 | 3.4.2 | GHSA-v9xq-vh72-chr4 |