CVE-2016-3732: Moodle sensitive information disclosure
Moodle sensitive information disclosure
Other sources
The capability check to access other badges in Moodle 3.0 through 3.0.3, 2.9 through 2.9.5, 2.8 through 2.8.11, 2.7 through 2.7.13, and earlier allows remote authenticated users to read the badges of other users.
Affected Software
Remediation
Recommended actions to resolve this vulnerability, in priority order.
- Upgrade
Upgrade
composer/moodle/moodleto a version that resolves this vulnerability.Fixed in 2.7.14 - Upgrade
Upgrade
composer/moodle/moodleto a version that resolves this vulnerability.Fixed in 2.8.12 - Upgrade
Upgrade
composer/moodle/moodleto a version that resolves this vulnerability.Fixed in 2.9.6 - Upgrade
Upgrade
composer/moodle/moodleto a version that resolves this vulnerability.Fixed in 3.0.4
Event History
Frequently Asked Questions
What is the severity of CVE-2016-3732?
CVE-2016-3732 has been classified as a medium severity vulnerability due to its impact on user data privacy.
How do I fix CVE-2016-3732?
To fix CVE-2016-3732, upgrade Moodle to versions 2.7.14, 2.8.12, 2.9.6, or 3.0.4.
What are the affected versions for CVE-2016-3732?
CVE-2016-3732 affects Moodle versions 2.7.0 to 2.7.13, 2.8.0 to 2.8.11, 2.9.0 to 2.9.5, and 3.0.0 to 3.0.3.
Who is affected by CVE-2016-3732?
Remote authenticated users are affected by CVE-2016-3732 as they can access the badges of other users.
What does CVE-2016-3732 allow an attacker to do?
CVE-2016-3732 allows an attacker to read the badges of other users in Moodle, compromising user privacy.