Information disclosure in Moodle - CVE-2016-3732
Published: April 21, 2017 / Updated: August 8, 2020
Vulnerability identifier: #VU39160
CSH Severity: Low
CVSS v4: 5.3 [CVSS:4.0/AV:N/AC:L/AT:N/PR:L/UI:N/VC:L/VI:N/VA:N/SC:N/SI:N/SA:N]
CVE-ID: CVE-2016-3732
CWE-ID: CWE-200
Exploitation vector: Remote access
Exploit availability:
No public exploit available
Vulnerability details
The vulnerability allows a remote authenticated user to gain access to sensitive information.
The capability check to access other badges in Moodle 3.0 through 3.0.3, 2.9 through 2.9.5, 2.8 through 2.8.11, 2.7 through 2.7.13, and earlier allows remote authenticated users to read the badges of other users.
Affected software
Moodle
Fedora
moodle
Fedora
moodle
How to mitigate CVE-2016-3732
Install update from vendor's website.
moodle - addressed in versions 2.7.19-1.el6, 2.9.6-1.fc23, 3.0.4-1.el7