CVE-2016-2154: Infoleak
Published May 22, 2016
·Updated
admin/tool/monitor/lib.php in Event Monitor in Moodle 2.8.x before 2.8.11, 2.9.x before 2.9.5, and 3.0.x before 3.0.3 does not consider the moodle/course:viewhiddencourses capability, which allows remote authenticated users to discover hidden course names by subscribing to a rule.
Affected Software
22 affected componentsFixes available
composer/moodle/moodle>=3.0.0<3.0.3
3.0.3
composer/moodle/moodle>=2.9.0<2.9.5
2.9.5
composer/moodle/moodle>=2.8.0<2.8.11
2.8.11
Moodle moodle=2.8.0
Moodle moodle=2.8.1
Moodle moodle=2.8.2
Moodle moodle=2.8.3
Moodle moodle=2.8.4
Moodle moodle=2.8.5
Moodle moodle=2.8.6
Moodle moodle=2.8.7
Moodle moodle=2.8.8
Moodle moodle=2.8.9
Moodle moodle=2.8.10
Moodle moodle=2.9.0
Moodle moodle=2.9.1
Moodle moodle=2.9.2
Moodle moodle=2.9.3
Moodle moodle=2.9.4
Moodle moodle=3.0.0
Moodle moodle=3.0.1
Moodle moodle=3.0.2
Event History
May 22, 2016
CVE Published
via MITRE·08:00 PM
Data Sourced
via MITRE·08:00 PM
Description
May 13, 2022
Advisory Published
via GitHub·01:12 AM
Frequently Asked Questions
1
What is the severity of CVE-2016-2154?
CVE-2016-2154 is considered a moderate severity vulnerability.
2
How do I fix CVE-2016-2154?
To fix CVE-2016-2154, upgrade Moodle to version 2.8.11, 2.9.5, or 3.0.3 or later.
3
What impact does CVE-2016-2154 have on Moodle users?
CVE-2016-2154 allows remote authenticated users to discover hidden course names, potentially leaking sensitive information.
4
Which versions of Moodle are affected by CVE-2016-2154?
CVE-2016-2154 affects Moodle versions 2.8.0 to 2.8.10, 2.9.0 to 2.9.4, and 3.0.0 to 3.0.2.
5
Is CVE-2016-2154 a remote code execution vulnerability?
No, CVE-2016-2154 is not a remote code execution vulnerability; it is an information disclosure vulnerability.