CVE-2016-3733
First published: Thu Apr 20 2017(Updated: )
The "restore teacher" feature in Moodle 3.0 through 3.0.3, 2.9 through 2.9.5, 2.8 through 2.8.11, 2.7 through 2.7.13, and earlier allows remote authenticated users to overwrite the course idnumber.
Credit: secalert@redhat.com secalert@redhat.com
| Affected Software | Affected Version | How to fix |
|---|---|---|
| composer/moodle/moodle | >=3.0<3.0.4 | 3.0.4 |
| composer/moodle/moodle | >=2.9<2.9.6 | 2.9.6 |
| composer/moodle/moodle | >=2.8<2.8.12 | 2.8.12 |
| composer/moodle/moodle | >=2.7<2.7.14 | 2.7.14 |
| Moodle | =2.7.0 | |
| Moodle | =2.7.0-beta | |
| Moodle | =2.7.0-rc1 | |
| Moodle | =2.7.0-rc2 | |
| Moodle | =2.7.1 | |
| Moodle | =2.7.2 | |
| Moodle | =2.7.3 | |
| Moodle | =2.7.4 | |
| Moodle | =2.7.5 | |
| Moodle | =2.7.6 | |
| Moodle | =2.7.7 | |
| Moodle | =2.7.8 | |
| Moodle | =2.7.9 | |
| Moodle | =2.7.10 | |
| Moodle | =2.7.11 | |
| Moodle | =2.7.12 | |
| Moodle | =2.7.13 | |
| Moodle | =2.8.0 | |
| Moodle | =2.8.1 | |
| Moodle | =2.8.2 | |
| Moodle | =2.8.3 | |
| Moodle | =2.8.4 | |
| Moodle | =2.8.5 | |
| Moodle | =2.8.6 | |
| Moodle | =2.8.7 | |
| Moodle | =2.8.8 | |
| Moodle | =2.8.9 | |
| Moodle | =2.8.10 | |
| Moodle | =2.8.11 | |
| Moodle | =2.9.0 | |
| Moodle | =2.9.1 | |
| Moodle | =2.9.2 | |
| Moodle | =2.9.3 | |
| Moodle | =2.9.4 | |
| Moodle | =2.9.5 | |
| Moodle | =3.0.0 | |
| Moodle | =3.0.0-beta | |
| Moodle | =3.0.0-rc1 | |
| Moodle | =3.0.0-rc2 | |
| Moodle | =3.0.0-rc3 | |
| Moodle | =3.0.0-rc4 | |
| Moodle | =3.0.1 | |
| Moodle | =3.0.2 | |
| Moodle | =3.0.3 |
Never miss a vulnerability like this again
Sign up to SecAlerts for real-time vulnerability data matched to your software, aggregated from hundreds of sources.
Reference Links
- http://git.moodle.org/gw?p=moodle.git&a=search&h=HEAD&st=commit&s=MDL-51369
- http://www.openwall.com/lists/oss-security/2016/05/17/4
- http://www.securitytracker.com/id/1035902
- https://bugzilla.redhat.com/show_bug.cgi?id=1335933
- https://nvd.nist.gov/vuln/detail/CVE-2016-3733
- https://github.com/moodle/moodle/commit/12c28574868d6f6e5c57fb63298c82cb8bdd0bb6
- https://github.com/moodle/moodle/commit/24b0c3c86ae96e46b87d6e9d6bcf4a6014dae8f0
- https://github.com/moodle/moodle/commit/2950f9fb9128f9ae48e00b864da90be76c2bf139
- https://github.com/moodle/moodle/commit/3c9d2b104023a8b9fdc5f4d7e136083babd2609a
- https://github.com/advisories/GHSA-gr8j-qm8r-rfgg (Advisory)
Frequently Asked Questions
What is the severity of CVE-2016-3733?
CVE-2016-3733 is classified as a medium severity vulnerability that allows remote authenticated users to overwrite course identifiers.
How do I fix CVE-2016-3733?
To fix CVE-2016-3733, upgrade your Moodle installation to version 3.0.4, 2.9.6, 2.8.12, or 2.7.14.
Which versions of Moodle are affected by CVE-2016-3733?
CVE-2016-3733 affects Moodle versions 3.0 through 3.0.3, 2.9 through 2.9.5, 2.8 through 2.8.11, and 2.7 through 2.7.13.
What type of attack does CVE-2016-3733 enable?
CVE-2016-3733 enables a remote authenticated user to manipulate course identification numbers, potentially impacting course management.
Is CVE-2016-3733 a local or remote vulnerability?
CVE-2016-3733 is a remote vulnerability, as it requires authentication but allows attacks over the network.
- agent/type
- collector/github-advisory-latest
- source/GitHub
- alias/GHSA-gr8j-qm8r-rfgg
- alias/CVE-2016-3733
- agent/software-canonical-lookup
- agent/remedy
- agent/severity
- agent/references
- agent/weakness
- agent/description
- agent/softwarecombine
- agent/author
- collector/github-advisory
- collector/mitre-cve
- source/MITRE
- agent/last-modified-date
- agent/first-publish-date
- agent/event
- agent/trending
- agent/source
- agent/tags
- collector/nvd-cve
- source/NVD
- agent/software-canonical-lookup-request
- collector/nvd-index
- package-manager/composer
- vendor/moodle
- canonical/moodle
- version/moodle/2.7.0
- version/moodle/2.7.0-beta
- version/moodle/2.7.0-rc1
- version/moodle/2.7.0-rc2
- version/moodle/2.7.1
- version/moodle/2.7.2
- version/moodle/2.7.3
- version/moodle/2.7.4
- version/moodle/2.7.5
- version/moodle/2.7.6
- version/moodle/2.7.7
- version/moodle/2.7.8
- version/moodle/2.7.9
- version/moodle/2.7.10
- version/moodle/2.7.11
- version/moodle/2.7.12
- version/moodle/2.7.13
- version/moodle/2.8.0
- version/moodle/2.8.1
- version/moodle/2.8.2
- version/moodle/2.8.3
- version/moodle/2.8.4
- version/moodle/2.8.5
- version/moodle/2.8.6
- version/moodle/2.8.7
- version/moodle/2.8.8
- version/moodle/2.8.9
- version/moodle/2.8.10
- version/moodle/2.8.11
- version/moodle/2.9.0
- version/moodle/2.9.1
- version/moodle/2.9.2
- version/moodle/2.9.3
- version/moodle/2.9.4
- version/moodle/2.9.5
- version/moodle/3.0.0
- version/moodle/3.0.0-beta
- version/moodle/3.0.0-rc1
- version/moodle/3.0.0-rc2
- version/moodle/3.0.0-rc3
- version/moodle/3.0.0-rc4
- version/moodle/3.0.1
- version/moodle/3.0.2
- version/moodle/3.0.3