PT-2016-1309 · Moodle · Moodle

Juan Leyva · Published 2016-01-20 · Updated 2022-05-13 · CVE-2016-0724

Positive Technologies (AI Summary)

CVSS v3.1

4.3

Medium

Base vector

AV:N/AC:L/PR:L/UI:N/S:U/C:L/I:N/A:N

Name of the Vulnerable Software and Affected Versions Moodle versions 2.6.11 and earlier, 2.7.x before 2.7.12, 2.8.x before 2.8.10, 2.9.x before 2.9.4, 3.0.x before 3.0.2

Description The issue is related to the core enrol get course enrolment methods and enrol self get instance info web services in Moodle, which do not consider the moodle/course:viewhiddencourses capability. This allows remote authenticated users to obtain sensitive information via a web-service request. The vulnerability is associated with insufficient access control, enabling a remote attacker to gain confidential information through a web service request.

Recommendations For versions 2.6.11 and earlier, update to a version later than 2.6.11 to resolve the issue. For versions 2.7.x before 2.7.12, update to version 2.7.12 or later. For versions 2.8.x before 2.8.10, update to version 2.8.10 or later. For versions 2.9.x before 2.9.4, update to version 2.9.4 or later. For versions 3.0.x before 3.0.2, update to version 3.0.2 or later. As a temporary workaround, consider restricting access to the core enrol get course enrolment methods and enrol self get instance info web services until a patch is available.

Fix

Information Disclosure

Weakness Enumeration

CWE-264

CWE-200

Related Identifiers

BDU:2016-00606

CVE-2016-0724

GHSA-HJRJ-7WCJ-7J3C

MGASA-2016-0029

Affected Products

Moodle

References · 23

• https://nvd.nist.gov/vuln/detail/CVE-2016-0724 · Security Note
• https://osv.dev/vulnerability/MGASA-2016-0029 · Vendor Advisory
• http://lists.fedoraproject.org/pipermail/package-announce/2016-January/176436.html · Vendor Advisory
• https://osv.dev/vulnerability/CVE-2016-0724 · Vendor Advisory
• https://moodle.org/mod/forum/discuss.php?d=326205 · Vendor Advisory
• http://lists.fedoraproject.org/pipermail/package-announce/2016-February/176502.html · Vendor Advisory
• https://bdu.fstec.ru/vul/2016-00606 · Security Note
• https://osv.dev/vulnerability/UBUNTU-CVE-2016-0724 · Vendor Advisory
• https://cve.org/CVERecord?id=CVE-2016-0724 · Security Note
• https://advisories.mageia.org/MGASA-2016-0029.html · Security Note
• https://ubuntu.com/security/CVE-2016-0724 · Vendor Advisory
• https://osv.dev/vulnerability/GHSA-hjrj-7wcj-7j3c · Vendor Advisory
• https://github.com/moodle/moodle · Note
• https://github.com/moodle/moodle/commit/4323a973d57a41e19e039a850ad71ebcabae73c1 · Note
• https://bugs.mageia.org/show_bug.cgi?id=17537 · Note