CVE-2016-2151: Moodle allows attackers to discover student e-mail addresses
Moodle allows attackers to discover student e-mail addresses
Other sources
user/index.php in Moodle through 2.6.11, 2.7.x before 2.7.13, 2.8.x before 2.8.11, 2.9.x before 2.9.5, and 3.0.x before 3.0.3 grants excessive authorization on the basis of the moodle/course:viewhiddenuserfields capability, which allows remote authenticated users to discover student e-mail addresses by leveraging the teacher role and reading a Participants list.
— GitHub
Affected Software
Remediation
Recommended actions to resolve this vulnerability, in priority order.
- Upgrade
Upgrade
composer/moodle/moodleto a version that resolves this vulnerability.Fixed in 3.0.3 - Upgrade
Upgrade
composer/moodle/moodleto a version that resolves this vulnerability.Fixed in 2.9.5 - Upgrade
Upgrade
composer/moodle/moodleto a version that resolves this vulnerability.Fixed in 2.8.11 - Upgrade
Upgrade
composer/moodle/moodleto a version that resolves this vulnerability.Fixed in 2.7.13
Event History
Frequently Asked Questions
What is the severity of CVE-2016-2151?
CVE-2016-2151 is considered a medium severity vulnerability that allows remote authenticated users to access hidden user fields, including student email addresses.
How do I fix CVE-2016-2151?
To fix CVE-2016-2151, update your Moodle installation to version 2.7.13, 2.8.11, 2.9.5, or 3.0.3 or later.
Which versions of Moodle are affected by CVE-2016-2151?
CVE-2016-2151 affects Moodle versions up to 2.6.11, and 2.7.x through 2.7.12, 2.8.x through 2.8.10, 2.9.x through 2.9.4, and 3.0.x through 3.0.2.
What capabilities are exploited in CVE-2016-2151?
CVE-2016-2151 exploits the 'moodle/course:viewhiddenuserfields' capability, allowing unauthorized access to user data.
Can CVE-2016-2151 be exploited remotely?
Yes, CVE-2016-2151 can be exploited remotely by authenticated users to access hidden email addresses of students.