Executive brief
Moodle, a widely used learning management system, is vulnerable to a flaw that allows unauthorized text to be inserted into email headers. An attacker could exploit this to send spam or malicious emails that appear to originate from the trusted Moodle server. This can damage an organization's reputation and lead to the server being blacklisted by email providers.
Technical details
A text injection vulnerability exists in Moodle's email handling component due to improper neutralization of special elements (CWE-74). By providing specially crafted input that is subsequently used in email headers, a remote attacker can inject additional SMTP commands or headers. This is typically achieved via CRLF injection, allowing the attacker to modify the 'To', 'Subject', or other header fields to redirect emails or send unsolicited bulk messages (spam). The vulnerability affects Moodle versions 2.x, 3.0.x, and 3.1.0. Patches have been released by the vendor to address this issue.
Affected products
- Moodle Moodle 2.x, 3.0.x, 3.1.0
Timeline
- 2016-07-18: disclosed: Initial disclosure date based on external references.
- 2017-01-20: advisory: NVD publication date.