Main Vulnerability Database Vulnerabilities #VU39811

Permissions, Privileges, and Access Controls in Moodle - CVE-2016-8644

Published: January 20, 2017 / Updated: August 8, 2020

Vulnerability identifier: #VU39811

CSH Severity: Medium

CVSS v4: 6.9 [CVSS:4.0/AV:N/AC:L/AT:N/PR:N/UI:N/VC:L/VI:N/VA:N/SC:N/SI:N/SA:N]

CVE-ID: CVE-2016-8644

CWE-ID: CWE-264

Exploitation vector: Remote access

Exploit availability: No public exploit available

Vulnerability details

The vulnerability allows a remote non-authenticated attacker to gain access to sensitive information.

In Moodle 2.x and 3.x, the capability to view course notes is checked in the wrong context.

Moodle
Fedora
moodle

Install update from vendor's website.

moodle - addressed in versions 3.1.4-1.el7, 3.1.4-1.fc24, 3.1.4-1.fc25