Track vulnerabilities like this one. Sign up free to get alerted when software you use is affected.
5.3

Moodle: Missing email links can aid phishing attacks

CVE-2021-36403 · published 3 years ago
Summary

Moodle's email notifications for messages may not include links back to the original message, making it harder to verify the email's authenticity, potentially allowing attackers to spoof messages that appear to come from Moodle. This issue affects users who rely on email notifications. To mitigate this risk, administrators should review and update their email notification settings to ensure links are included.

What to do
  • Update moodle moodle to version 3.11.1.
  • Update moodle moodle to version 3.10.5.
  • Update moodle moodle to version 3.9.8.
Affected software
Ecosystem VendorProductAffected versions
composer moodle moodle >= 3.11.0-beta, < 3.11.1
>= 3.10.0-beta, < 3.10.5
< 3.9.8
Fix: upgrade to 3.11.1
– moodle moodle >= 3.10.0, < 3.10.5
>= 3.11.0, < 3.11.1
cpe:2.3:a:moodle:moodle:*:*:*:*:*:*:*:*
Ubuntu:16.04:LTS canonical moodle All versions
Original advisory text
In Moodle, in some circumstances, email notifications of messages could have the link back to the original message hidden by HTML, which may pose a phishing risk.
In Moodle, in some circumstances, email notifications of messages could have the link back to the original message hidden by HTML, which may pose a phishing risk.
References
Fix within
Internet-facing 14 days
Internal 60 days
  • Not known to be exploited
  • Can be exploited automatically
  • Gives an attacker partial control
Severity
5.3 Medium
Exploitation
<1% chance of attack within 30 days
Type
CWE-912Hidden Functionality
Timeline
Published6 Mar 2023
Updated4 Nov 2026
First seen6 Mar 2026
Sources
GHSA-j9cw-5cpj-9qj5 · GHSA
CVE-2021-36403 · NVD
UBUNTU-CVE-2021-36403 · OSV
CVE-2021-36403 · OSV
Track software like this
Free during beta