PT-2017-1085 · Moodle · Moodle

Juan Leyva · Published 2017-01-20 · Updated 2020-12-01 · CVE-2016-8643

Positive Technologies (AI Summary)

CVSS v3.1

4.3

Medium

Base vector

AV:N/AC:L/PR:L/UI:N/S:U/C:N/I:L/A:N

Name of the Vulnerable Software and Affected Versions Moodle versions 2.x through 3.x

Description The issue is related to insufficient access control in the administration service of the Moodle learning management system. This can potentially allow a remote attacker to compromise the confidentiality of information. Non-admin site managers may accidentally edit admin accounts via web services.

Recommendations For Moodle versions 2.x through 3.x, restrict access to web services for non-admin site managers to prevent accidental editing of admin accounts. As a temporary workaround, consider disabling web services for non-admin site managers until a proper fix is implemented.

Fix

Improper Access Control

Weakness Enumeration

CWE-284

Related Identifiers

BDU:2017-00178

CVE-2016-8643

Affected Products

Moodle

References · 10

• https://ubuntu.com/security/CVE-2016-8643 · Vendor Advisory
• https://moodle.org/mod/forum/discuss.php?d=343276 · Vendor Advisory
• https://osv.dev/vulnerability/UBUNTU-CVE-2016-8643 · Vendor Advisory
• https://nvd.nist.gov/vuln/detail/CVE-2016-8643 · Security Note
• https://osv.dev/vulnerability/CVE-2016-8643 · Vendor Advisory
• https://bdu.fstec.ru/vul/2017-00178 · Security Note
• https://cve.org/CVERecord?id=CVE-2016-8643 · Security Note
• https://tracker.moodle.org/browse/MDL-56065 · Note
• http://securityfocus.com/bid/94457 · Note
• https://cve.mitre.org/cgi-bin/cvename.cgi?name=CVE-2016-8643 · Note