TI-2018-01001 Aliases CVE-2018-1082 GHSA-qh8m-6g4p-33h3

Improper authorization in Red Hat Moodle

LOW 39CWE-285Published 2018-04-04 · Updated 2024-09-16

Key facts

Attack vector: Network
Privileges required: None
User interaction: None
Attack complexity: High
Impact type: Security bypass
Confidentiality · integrity · availability: High · High · High
Fix status: Fixed

Attack profile from CVSS 3.0 · NVD. Fix status from CNA and GitHub. Impact type from CWE-285.

Summary

A flaw was found in Moodle 3.4 to 3.4.1, and 3.3 to 3.3.4. If a user account using OAuth2 authentication method was once confirmed but later suspended, the user could still login to the site.

Why it matters now

EPSS 0.01995 80th percentileScored 2026-11-07

Fix Fixed moodle/moodle (Packagist): 3.3.5, 3.4.2

SSVC decision points

Not available: CISA has not published SSVC decision points for this record.

Affected products

Vendor	Product	Affected versions	Fixed in	Status	Source
Red Hat	Moodle	3.4 to 3.4.1, 3.3 to 3.3.4	—	No fix listed	CNA
—	moodle/moodle (Packagist)	3.3 to before 3.3.5	3.3.5	Patch available	GHSA-qh8m-6g4p-33h3
—	moodle/moodle (Packagist)	3.4 to before 3.4.2	3.4.2	Patch available	GHSA-qh8m-6g4p-33h3

Moodle VendorRed Hat Affected 3.4 to 3.4.1, 3.3 to 3.3.4 Fixed in — No fix listed CNA
moodle/moodle (Packagist) Vendor— Affected 3.3 to before 3.3.5 Fixed in 3.3.5 Patch available GHSA-qh8m-6g4p-33h3
moodle/moodle (Packagist) Vendor— Affected 3.4 to before 3.4.2 Fixed in 3.4.2 Patch available GHSA-qh8m-6g4p-33h3

CPE configurations NVD · 1

CPE	Versions	Role	Vendor
cpe:2.3:a:moodle:moodle::::::::	3.3.0 – 3.3.4; 3.4.0 – 3.4.1	Vulnerable	Moodle

cpe:2.3:a:moodle:moodle:*:*:*:*:*:*:*:* Versions 3.3.0 – 3.3.4; 3.4.0 – 3.4.1 Vulnerable ·Moodle

Remediation

Fix · GHSA-qh8m-6g4p-33h3 moodle/moodle (Packagist) Fixed in 3.3.5 Advisory →
Fix · GHSA-qh8m-6g4p-33h3 moodle/moodle (Packagist) Fixed in 3.4.2 Advisory →

Timeline

2026-10-02 Threatist record created from CVE-2018-1082
2026-10-03 Alias added: GHSA-qh8m-6g4p-33h3

References

Patch 1

http://git.moodle.org/gw?p=moodle.git&a=search&h=HEAD&st=commit&s=MDL-60101

Advisory 2

Other 1

https://github.com/moodle/moodle

TI-2019-15875 Protection mechanism failure in Jenkins Pipeline: Groovy Plugin KEVCVSS 3.1CRITICAL 9.9
TI-2019-15874 Protection mechanism failure in Jenkins Script Security Plugin KEVCVSS 3.1CRITICAL 9.9
TI-2019-08259 Underflow in PHP-FPM can lead to RCE KEVCVSS 3.1CRITICAL 9.8
TI-2019-05363 Code injection in Elastic Kibana KEVCVSS 3.1CRITICAL 10.0
TI-2019-03949 Out-of-bounds write in ESXi and Horizon DaaS KEVCVSS 3.1CRITICAL 9.8
TI-2018-16080 A code execution vulnerability exists in the Stapler web framework used by Jenkins 2.153… KEVCVSS 3.1CRITICAL 9.8

See all 7412 →

Sources

This product uses the NVD API but is not endorsed or certified by the NVD. Sources and licences