CVE-2016-2154: Moodle allows attackers to discover hidden course names
admin/tool/monitor/lib.php in Event Monitor in Moodle 2.8.x before 2.8.11, 2.9.x before 2.9.5, and 3.0.x before 3.0.3 does not consider the moodle/course:viewhiddencourses capability, which allows remote authenticated users to discover hidden course names by subscribing to a rule.
Other sources
Moodle allows attackers to discover hidden course names
— Packagist
Affected Software
Remediation
Recommended actions to resolve this vulnerability, in priority order.
- Upgrade
Upgrade
composer/moodle/moodleto a version that resolves this vulnerability.Fixed in 3.0.3 - Upgrade
Upgrade
composer/moodle/moodleto a version that resolves this vulnerability.Fixed in 2.9.5 - Upgrade
Upgrade
composer/moodle/moodleto a version that resolves this vulnerability.Fixed in 2.8.11
Event History
Frequently Asked Questions
What is the severity of CVE-2016-2154?
CVE-2016-2154 is considered a moderate severity vulnerability.
How do I fix CVE-2016-2154?
To fix CVE-2016-2154, upgrade Moodle to version 2.8.11, 2.9.5, or 3.0.3 or later.
What impact does CVE-2016-2154 have on Moodle users?
CVE-2016-2154 allows remote authenticated users to discover hidden course names, potentially leaking sensitive information.
Which versions of Moodle are affected by CVE-2016-2154?
CVE-2016-2154 affects Moodle versions 2.8.0 to 2.8.10, 2.9.0 to 2.9.4, and 3.0.0 to 3.0.2.
Is CVE-2016-2154 a remote code execution vulnerability?
No, CVE-2016-2154 is not a remote code execution vulnerability; it is an information disclosure vulnerability.