Main Vulnerability Database Vulnerabilities #VU39809

Improper access control in Moodle - CVE-2016-8642

Published: January 20, 2017 / Updated: August 8, 2020

Vulnerability identifier: #VU39809

CSH Severity: Medium

CVSS v4: 6.9 [CVSS:4.0/AV:N/AC:L/AT:N/PR:N/UI:N/VC:L/VI:N/VA:N/SC:N/SI:N/SA:N]

CVE-ID: CVE-2016-8642

CWE-ID: CWE-284

Exploitation vector: Remote access

Exploit availability: No public exploit available

Vulnerability details

The vulnerability allows a remote non-authenticated attacker to gain access to sensitive information.

In Moodle 2.x and 3.x, the question engine allows access to files that should not be available.

Moodle
Fedora
moodle

Install update from vendor's website.

moodle - addressed in versions 3.1.4-1.el7, 3.1.4-1.fc24, 3.1.4-1.fc25