CVE-2016-5014: Infoleak
Published Jan 20, 2017
·Updated
In Moodle 2.x and 3.x, an unenrolled user still receives event monitor notifications even though they can no longer access the course.
Affected Software
30 affected componentsFixes available
composer/moodle/moodle>=2.8.0<=2.8.12
composer/moodle/moodle>=2.9.0<=2.9.6
2.9.7
composer/moodle/moodle>=3.0.0<=3.0.4
3.0.5
composer/moodle/moodle=3.1.0
3.1.1
Moodle moodle=2.8.0
Moodle moodle=2.8.1
Moodle moodle=2.8.2
Moodle moodle=2.8.3
Moodle moodle=2.8.4
Moodle moodle=2.8.5
Moodle moodle=2.8.6
Moodle moodle=2.8.7
Moodle moodle=2.8.8
Moodle moodle=2.8.9
Moodle moodle=2.8.10
Moodle moodle=2.8.11
Moodle moodle=2.8.12
Moodle moodle=2.9.0
Moodle moodle=2.9.1
Moodle moodle=2.9.2
Moodle moodle=2.9.3
Moodle moodle=2.9.4
Moodle moodle=2.9.5
Moodle moodle=2.9.6
Moodle moodle=3.0.0
Moodle moodle=3.0.1
Moodle moodle=3.0.2
Moodle moodle=3.0.3
Moodle moodle=3.0.4
Moodle moodle=3.1.0
Remediation
Patch Available
Event History
Jan 20, 2017
CVE Published
via MITRE·08:39 AM
Data Sourced
via MITRE·08:39 AM
Description
Data Sourced
via NVD·08:59 AM
RemedyDescriptionSeverityWeaknessAffected Software
May 13, 2022
Advisory Published
01:12 AM
Frequently Asked Questions
1
What is the severity of CVE-2016-5014?
CVE-2016-5014 has been classified as a medium severity vulnerability due to the potential information leakage it can cause.
2
How do I fix CVE-2016-5014?
To resolve CVE-2016-5014, upgrade your Moodle installation to version 2.9.7, 3.0.5, or 3.1.1.
3
Which versions of Moodle are affected by CVE-2016-5014?
CVE-2016-5014 affects Moodle versions 2.8.0 through 2.8.12 and all 2.9.x and 3.0.x versions prior to the required updates.
4
What is the nature of the vulnerability reported in CVE-2016-5014?
The vulnerability allows unenrolled users to still receive event monitor notifications for courses they can no longer access.
5
Is there a workaround for CVE-2016-5014?
Currently, no official workaround is recommended; upgrading to the fixed versions is advised to mitigate this vulnerability.