PT-2016-1309 · Moodle · Moodle
Juan Leyva
·
Publicado
2016-01-20
·
Atualizado
2022-05-13
·
CVE-2016-0724
CVSS v3.1
4.3
Média
| Vetor | AV:N/AC:L/PR:L/UI:N/S:U/C:L/I:N/A:N |
Name of the Vulnerable Software and Affected Versions
Moodle versions 2.6.11 and earlier, 2.7.x before 2.7.12, 2.8.x before 2.8.10, 2.9.x before 2.9.4, 3.0.x before 3.0.2
Description
The issue is related to the core enrol get course enrolment methods and enrol self get instance info web services in Moodle, which do not consider the moodle/course:viewhiddencourses capability. This allows remote authenticated users to obtain sensitive information via a web-service request. The vulnerability is associated with insufficient access control, enabling a remote attacker to gain confidential information through a web service request.
Recommendations
For versions 2.6.11 and earlier, update to a version later than 2.6.11 to resolve the issue.
For versions 2.7.x before 2.7.12, update to version 2.7.12 or later.
For versions 2.8.x before 2.8.10, update to version 2.8.10 or later.
For versions 2.9.x before 2.9.4, update to version 2.9.4 or later.
For versions 3.0.x before 3.0.2, update to version 3.0.2 or later.
As a temporary workaround, consider restricting access to the core enrol get course enrolment methods and enrol self get instance info web services until a patch is available.
Correção
Information Disclosure
Encontrou algum problema na descrição? Tem algo a acrescentar? Fique à vontade para nos escrever 👾
Identificadores relacionados
Produtos afetados
Moodle