CVE-2016-3732: Infoleak
Published Apr 20, 2017
·Updated
The capability check to access other badges in Moodle 3.0 through 3.0.3, 2.9 through 2.9.5, 2.8 through 2.8.11, 2.7 through 2.7.13, and earlier allows remote authenticated users to read the badges of other users.
Affected Software
48 affected componentsFixes available
composer/moodle/moodle>=2.7.0<=2.7.13
2.7.14
composer/moodle/moodle>=2.8.0<=2.8.11
2.8.12
composer/moodle/moodle>=2.9.0<=2.9.5
2.9.6
composer/moodle/moodle>=3.0.0<=3.0.3
3.0.4
Moodle moodle=2.7.0
Moodle moodle=2.7.0-beta
Moodle moodle=2.7.0-rc1
Moodle moodle=2.7.0-rc2
Moodle moodle=2.7.1
Moodle moodle=2.7.2
Moodle moodle=2.7.3
Moodle moodle=2.7.4
Moodle moodle=2.7.5
Moodle moodle=2.7.6
Moodle moodle=2.7.7
Moodle moodle=2.7.8
Moodle moodle=2.7.9
Moodle moodle=2.7.10
Moodle moodle=2.7.11
Moodle moodle=2.7.12
Moodle moodle=2.7.13
Moodle moodle=2.8.0
Moodle moodle=2.8.1
Moodle moodle=2.8.2
Moodle moodle=2.8.3
Moodle moodle=2.8.4
Moodle moodle=2.8.5
Moodle moodle=2.8.6
Moodle moodle=2.8.7
Moodle moodle=2.8.8
Moodle moodle=2.8.9
Moodle moodle=2.8.10
Moodle moodle=2.8.11
Moodle moodle=2.9.0
Moodle moodle=2.9.1
Moodle moodle=2.9.2
Moodle moodle=2.9.3
Moodle moodle=2.9.4
Moodle moodle=2.9.5
Moodle moodle=3.0.0
Moodle moodle=3.0.0-beta
Moodle moodle=3.0.0-rc1
Moodle moodle=3.0.0-rc2
Moodle moodle=3.0.0-rc3
Moodle moodle=3.0.0-rc4
Moodle moodle=3.0.1
Moodle moodle=3.0.2
Moodle moodle=3.0.3
Event History
Apr 20, 2017
CVE Published
via MITRE·09:00 PM
Data Sourced
via MITRE·09:00 PM
Description
May 13, 2022
Advisory Published
01:12 AM
Frequently Asked Questions
1
What is the severity of CVE-2016-3732?
CVE-2016-3732 has been classified as a medium severity vulnerability due to its impact on user data privacy.
2
How do I fix CVE-2016-3732?
To fix CVE-2016-3732, upgrade Moodle to versions 2.7.14, 2.8.12, 2.9.6, or 3.0.4.
3
What are the affected versions for CVE-2016-3732?
CVE-2016-3732 affects Moodle versions 2.7.0 to 2.7.13, 2.8.0 to 2.8.11, 2.9.0 to 2.9.5, and 3.0.0 to 3.0.3.
4
Who is affected by CVE-2016-3732?
Remote authenticated users are affected by CVE-2016-3732 as they can access the badges of other users.
5
What does CVE-2016-3732 allow an attacker to do?
CVE-2016-3732 allows an attacker to read the badges of other users in Moodle, compromising user privacy.