CVE Vulnerabilities

CVE-2016-5013

Improper Neutralization of Special Elements in Output Used by a Downstream Component ('Injection')

Published: Jan 20, 2017 | Modified: Dec 01, 2020
CVSS 3.x
5.4
MEDIUM
Source:
NVD
CVSS:3.0/AV:N/AC:L/PR:N/UI:R/S:U/C:L/I:L/A:N
CVSS 2.x
5.8 MEDIUM
AV:N/AC:M/Au:N/C:P/I:P/A:N
RedHat/V2
RedHat/V3
Ubuntu
MEDIUM

In Moodle 2.x and 3.x, text injection can occur in email headers, potentially leading to outbound spam.

Weakness

The product constructs all or part of a command, data structure, or record using externally-influenced input from an upstream component, but it does not neutralize or incorrectly neutralizes special elements that could modify how it is parsed or interpreted when it is sent to a downstream component.

Affected Software

Name Vendor Start Version End Version
Moodle Moodle * 2.7.14 (including)
Moodle Moodle 2.8.0 (including) 2.8.0 (including)
Moodle Moodle 2.8.1 (including) 2.8.1 (including)
Moodle Moodle 2.8.2 (including) 2.8.2 (including)
Moodle Moodle 2.8.3 (including) 2.8.3 (including)
Moodle Moodle 2.8.4 (including) 2.8.4 (including)
Moodle Moodle 2.8.5 (including) 2.8.5 (including)
Moodle Moodle 2.8.6 (including) 2.8.6 (including)
Moodle Moodle 2.8.7 (including) 2.8.7 (including)
Moodle Moodle 2.8.8 (including) 2.8.8 (including)
Moodle Moodle 2.8.9 (including) 2.8.9 (including)
Moodle Moodle 2.8.10 (including) 2.8.10 (including)
Moodle Moodle 2.8.11 (including) 2.8.11 (including)
Moodle Moodle 2.8.12 (including) 2.8.12 (including)
Moodle Moodle 2.9.0 (including) 2.9.0 (including)
Moodle Moodle 2.9.1 (including) 2.9.1 (including)
Moodle Moodle 2.9.2 (including) 2.9.2 (including)
Moodle Moodle 2.9.3 (including) 2.9.3 (including)
Moodle Moodle 2.9.4 (including) 2.9.4 (including)
Moodle Moodle 2.9.5 (including) 2.9.5 (including)
Moodle Moodle 2.9.6 (including) 2.9.6 (including)
Moodle Moodle 3.0.0 (including) 3.0.0 (including)
Moodle Moodle 3.0.1 (including) 3.0.1 (including)
Moodle Moodle 3.0.2 (including) 3.0.2 (including)
Moodle Moodle 3.0.3 (including) 3.0.3 (including)
Moodle Moodle 3.0.4 (including) 3.0.4 (including)
Moodle Moodle 3.1.0 (including) 3.1.0 (including)
Moodle Ubuntu bionic *
Moodle Ubuntu cosmic *
Moodle Ubuntu disco *
Moodle Ubuntu eoan *
Moodle Ubuntu esm-apps/bionic *
Moodle Ubuntu esm-apps/xenial *
Moodle Ubuntu precise *
Moodle Ubuntu trusty *
Moodle Ubuntu upstream *
Moodle Ubuntu wily *
Moodle Ubuntu xenial *

Potential Mitigations

References