PT-2016-5038 · Moodle · Moodle

Krista Koivisto

·

Publicado

2016-03-25

·

Atualizado

2022-05-13

·

CVE-2016-2158

CVSS v3.1

4.3

Média

VetorAV:N/AC:L/PR:L/UI:N/S:U/C:L/I:N/A:N
Name of the Vulnerable Software and Affected Versions Moodle versions 2.6.11 and earlier, 2.7.x through 2.7.12, 2.8.x through 2.8.10, 2.9.x through 2.9.4, 3.0.x through 3.0.2
Description The issue allows remote attackers to obtain sensitive category-detail information from the navigation branch by leveraging the guest role for an Ajax request when the forcelogin feature is enabled.
Recommendations For versions 2.6.11 and earlier, update to version 2.6.12 or later. For versions 2.7.x through 2.7.12, update to version 2.7.13 or later. For versions 2.8.x through 2.8.10, update to version 2.8.11 or later. For versions 2.9.x through 2.9.4, update to version 2.9.5 or later. For versions 3.0.x through 3.0.2, update to version 3.0.3 or later.

Correção

Information Disclosure

Encontrou algum problema na descrição? Tem algo a acrescentar? Fique à vontade para nos escrever 👾
dbugs@ptsecurity.com

Enumeração de Fraquezas

CWE-200

Identificadores relacionados

CVE-2016-2158
GHSA-M882-J7GQ-V9P7
MGASA-2016-0122

Produtos afetados

Moodle