CVE-2016-5014: Moodle sensitive information disclosure
In Moodle 2.x and 3.x, an unenrolled user still receives event monitor notifications even though they can no longer access the course.
Affected Software
Remediation
Recommended actions to resolve this vulnerability, in priority order.
- Upgrade
Upgrade
composer/moodle/moodleto a version that resolves this vulnerability.Fixed in 2.9.7 - Upgrade
Upgrade
composer/moodle/moodleto a version that resolves this vulnerability.Fixed in 3.0.5 - Upgrade
Upgrade
composer/moodle/moodleto a version that resolves this vulnerability.Fixed in 3.1.1
Event History
Frequently Asked Questions
What is the severity of CVE-2016-5014?
CVE-2016-5014 has been classified as a medium severity vulnerability due to the potential information leakage it can cause.
How do I fix CVE-2016-5014?
To resolve CVE-2016-5014, upgrade your Moodle installation to version 2.9.7, 3.0.5, or 3.1.1.
Which versions of Moodle are affected by CVE-2016-5014?
CVE-2016-5014 affects Moodle versions 2.8.0 through 2.8.12 and all 2.9.x and 3.0.x versions prior to the required updates.
What is the nature of the vulnerability reported in CVE-2016-5014?
The vulnerability allows unenrolled users to still receive event monitor notifications for courses they can no longer access.
Is there a workaround for CVE-2016-5014?
Currently, no official workaround is recommended; upgrading to the fixed versions is advised to mitigate this vulnerability.