CVE-2016-2158: Infoleak
lib/ajax/getnavbranch.php in Moodle through 2.6.11, 2.7.x before 2.7.13, 2.8.x before 2.8.11, 2.9.x before 2.9.5, and 3.0.x before 3.0.3, when the forcelogin feature is enabled, allows remote attackers to obtain sensitive category-detail information from the navigation branch by leveraging the guest role for an Ajax request.
Affected Software
Event History
Frequently Asked Questions
What is the severity of CVE-2016-2158?
CVE-2016-2158 is classified as a medium severity vulnerability that allows remote attackers to access sensitive category-details in Moodle.
How do I fix CVE-2016-2158?
To fix CVE-2016-2158, upgrade to Moodle versions 2.7.13, 2.8.11, 2.9.5, or 3.0.3 or higher.
Which versions of Moodle are affected by CVE-2016-2158?
CVE-2016-2158 affects Moodle versions from 2.6.11 up to but not including 2.7.13, 2.8.11, 2.9.5, and 3.0.3.
What kind of information can be accessed through CVE-2016-2158?
CVE-2016-2158 allows attackers to obtain sensitive category-detail information in the navigation branch of Moodle.
Is the forcelogin feature related to CVE-2016-2158?
Yes, the vulnerability in CVE-2016-2158 is triggered when the forcelogin feature is enabled in Moodle.