CVE-2016-5012: Infoleak
Published Jan 20, 2017
·Updated
In Moodle 3.x, glossary search displays entries without checking user permissions to view them.
Affected Software
5 affected componentsFixes available
composer/moodle/moodle>=3.1<3.1.1
3.1.1
Moodle moodle=3.1.0
Moodle moodle=3.1.0-beta
Moodle moodle=3.1.0-rc1
Moodle moodle=3.1.0-rc2
Remediation
Patch Available
Event History
Jan 20, 2017
CVE Published
via MITRE·08:39 AM
Data Sourced
via MITRE·08:39 AM
Description
Data Sourced
via NVD·08:59 AM
RemedyDescriptionSeverityWeaknessAffected Software
May 17, 2022
Advisory Published
via GitHub·03:03 AM
Frequently Asked Questions
1
What is the severity of CVE-2016-5012?
CVE-2016-5012 has a medium severity rating due to improper permission checks allowing unauthorized access to glossary entries.
2
How do I fix CVE-2016-5012?
To fix CVE-2016-5012, upgrade to Moodle version 3.1.1 or a later version.
3
What versions of Moodle are affected by CVE-2016-5012?
CVE-2016-5012 affects Moodle versions 3.1.0, 3.1.0-beta, 3.1.0-rc1, and 3.1.0-rc2.
4
What impact does CVE-2016-5012 have on user privacy?
CVE-2016-5012 can compromise user privacy by displaying glossary entries without verifying permissions.
5
Is there a workaround for CVE-2016-5012 if I cannot upgrade Moodle?
There are no recommended workarounds for CVE-2016-5012, so upgrading is essential to mitigate the vulnerability.