CVE-2018-1081: Improper Access Control

April 4, 2018 (updated October 9, 2019)

Unauthenticated users can trigger custom messages to admin via paypal enrol script. Paypal IPN callback script should only send error emails to admin after request origin was verified, otherwise admin email can be spammed.

References

www.securityfocus.com/bid/103728
moodle.org/mod/forum/discuss.php?d=367938
nvd.nist.gov/vuln/detail/CVE-2018-1081

Detect and mitigate CVE-2018-1081 with GitLab Dependency Scanning

Secure your software supply chain by verifying that all open source dependencies used in your projects contain no disclosed vulnerabilities. Learn more about Dependency Scanning →