CVE-2016-5013: Moodle Does Not Escape Characters In Email Headers
In Moodle 2.x and 3.x, text injection can occur in email headers, potentially leading to outbound spam.
Other sources
Moodle Does Not Escape Characters In Email Headers
— Packagist
Affected Software
Remediation
Recommended actions to resolve this vulnerability, in priority order.
- Upgrade
Upgrade
composer/moodle/moodleto a version that resolves this vulnerability.Fixed in 3.1.1 - Upgrade
Upgrade
composer/moodle/moodleto a version that resolves this vulnerability.Fixed in 2.7.15 - Upgrade
Upgrade
composer/moodle/moodleto a version that resolves this vulnerability.Fixed in 2.9.7 - Upgrade
Upgrade
composer/moodle/moodleto a version that resolves this vulnerability.Fixed in 3.0.5
Event History
Frequently Asked Questions
What is the severity of CVE-2016-5013?
The severity of CVE-2016-5013 is classified as moderate, as it poses a risk of outbound spam through email headers.
How do I fix CVE-2016-5013?
To fix CVE-2016-5013, upgrade to Moodle versions 3.1.1, 3.0.5, 2.9.7, or 2.7.15.
Which versions of Moodle are affected by CVE-2016-5013?
CVE-2016-5013 affects Moodle versions 2.7.x, 2.8.x, 2.9.x, 3.0.x, and 3.1.0.
Is there a workaround for CVE-2016-5013 if I can't update immediately?
There is no official workaround for CVE-2016-5013, updating to a non-vulnerable version is recommended.
Can CVE-2016-5013 be exploited remotely?
Yes, CVE-2016-5013 can be exploited remotely if an attacker can manipulate email headers.