PT-2017-1085 · Moodle · Moodle

Juan Leyva · Publicado 2017-01-20 · Atualizado 2020-12-01 · CVE-2016-8643

Positive Technologies (AI Summary)

CVSS v3.1

4.3

Média

Vetor base

AV:N/AC:L/PR:L/UI:N/S:U/C:N/I:L/A:N

Name of the Vulnerable Software and Affected Versions Moodle versions 2.x through 3.x

Description The issue is related to insufficient access control in the administration service of the Moodle learning management system. This can potentially allow a remote attacker to compromise the confidentiality of information. Non-admin site managers may accidentally edit admin accounts via web services.

Recommendations For Moodle versions 2.x through 3.x, restrict access to web services for non-admin site managers to prevent accidental editing of admin accounts. As a temporary workaround, consider disabling web services for non-admin site managers until a proper fix is implemented.

Correção

Improper Access Control

Enumeração de Fraquezas

CWE-284

Identificadores relacionados

BDU:2017-00178

CVE-2016-8643

Produtos afetados

Moodle

Referências · 10

• https://ubuntu.com/security/CVE-2016-8643 · Aviso do Fabricante
• https://tracker.moodle.org/browse/MDL-56065 · Nota
• https://moodle.org/mod/forum/discuss.php?d=343276 · Aviso do Fabricante
• http://securityfocus.com/bid/94457 · Nota
• https://osv.dev/vulnerability/UBUNTU-CVE-2016-8643 · Aviso do Fabricante
• https://cve.mitre.org/cgi-bin/cvename.cgi?name=CVE-2016-8643 · Nota
• https://nvd.nist.gov/vuln/detail/CVE-2016-8643 · Nota de Segurança
• https://osv.dev/vulnerability/CVE-2016-8643 · Aviso do Fabricante
• https://bdu.fstec.ru/vul/2017-00178 · Nota de Segurança
• https://cve.org/CVERecord?id=CVE-2016-8643 · Nota de Segurança