CVE-2016-2156: Infoleak
calendar/externallib.php in Moodle through 2.6.11, 2.7.x before 2.7.13, 2.8.x before 2.8.11, 2.9.x before 2.9.5, and 3.0.x before 3.0.3 provides calendar-event data without considering whether an activity is hidden, which allows remote authenticated users to obtain sensitive information via a web-service request.
Affected Software
Event History
Frequently Asked Questions
What is the severity of CVE-2016-2156?
CVE-2016-2156 has a medium severity level, allowing remote authenticated users to access sensitive calendar event data.
How do I fix CVE-2016-2156?
To fix CVE-2016-2156, upgrade Moodle to version 2.7.13, 2.8.11, 2.9.5, or 3.0.3, as these versions address the vulnerability.
What versions of Moodle are affected by CVE-2016-2156?
CVE-2016-2156 affects Moodle versions up to 2.6.11 and all versions of 2.7.x prior to 2.7.13, 2.8.x prior to 2.8.11, 2.9.x prior to 2.9.5, and 3.0.x prior to 3.0.3.
Who can exploit the vulnerability in CVE-2016-2156?
The vulnerability in CVE-2016-2156 can be exploited by remote authenticated users who are able to access the Moodle platform.
What type of information can be exposed through CVE-2016-2156?
CVE-2016-2156 can expose sensitive calendar-event data that should be hidden from unauthorized users.