Moodle Setting for blocked hosts list can be bypassed with multiple A record hostnames

MEDIUM 6.5CVE-2018-1043 · GHSA-hpwm-84h5-vqr8 · Published 22/01/2018 · updated 17/06/2026

In short

CVE-2018-1043 is a MEDIUM (CVSS 6.5) vulnerability affecting moodle/moodle, moodle (moodle).
Chance of exploitation in the next 30 days (EPSS): 1.5%, higher than 73.5% of all vulnerabilities.
Fix: update to 3.2.7, 3.3.4, 3.4.1 or later.

Package	Affected versions	Patched versions
moodle/moodle Packagist	`≥ 3.2, < 3.2.7≥ 3.3, < 3.3.4≥ 3.4, < 3.4.1`	`3.2.73.3.43.4.1`
moodle moodle	`= 3.2.0= 3.2.1= 3.2.2= 3.2.3= 3.2.4= 3.2.5= 3.2.6= 3.3.0= 3.3.1= 3.3.2= 3.3.3= 3.4.0`	No fix yet

In Moodle 3.x, the setting for blocked hosts list can be bypassed with multiple A record hostnames.

NVD description

In Moodle 3.x, the setting for blocked hosts list can be bypassed with multiple A record hostnames.

Running one of these products? Scan your site to see whether it exposes a vulnerable version.

Package

Affected versions

Patched versions

Packagist

≥ 3.2, < 3.2.7≥ 3.3, < 3.3.4≥ 3.4, < 3.4.1

3.2.73.3.43.4.1

= 3.2.0= 3.2.1= 3.2.2= 3.2.3= 3.2.4= 3.2.5= 3.2.6= 3.3.0= 3.3.1= 3.3.2= 3.3.3= 3.4.0

No fix yet

More vulnerabilities in moodle/moodle

See all →