CVE-2016-7038: Moodle Weak Password Recovery Mechanism for Forgotten Password
In Moodle 2.x and 3.x, web service tokens are not invalidated when the user password is changed or forced to be changed.
Other sources
Moodle Weak Password Recovery Mechanism for Forgotten Password
— Packagist
Affected Software
Remediation
Recommended actions to resolve this vulnerability, in priority order.
- Upgrade
Upgrade
composer/moodle/moodleto a version that resolves this vulnerability.Fixed in 3.1.2 - Upgrade
Upgrade
composer/moodle/moodleto a version that resolves this vulnerability.Fixed in 3.0.6 - Upgrade
Upgrade
composer/moodle/moodleto a version that resolves this vulnerability.Fixed in 2.9.8 - Upgrade
Upgrade
composer/moodle/moodleto a version that resolves this vulnerability.Fixed in 2.7.16
Event History
Frequently Asked Questions
What is the severity of CVE-2016-7038?
CVE-2016-7038 is classified as a medium severity vulnerability.
How do I fix CVE-2016-7038?
To fix CVE-2016-7038, upgrade to Moodle version 2.7.16, 2.8.12, 2.9.8, or 3.0.6 and above.
What exactly does CVE-2016-7038 exploit?
CVE-2016-7038 exploits the vulnerability where web service tokens are not invalidated after a password change.
Which versions of Moodle are affected by CVE-2016-7038?
CVE-2016-7038 affects Moodle versions 2.7.15 and below, 2.8.0 to 2.8.11, 2.9.0 to 2.9.7, and 3.0.0 to 3.0.5.
What are the risks of CVE-2016-7038 if not mitigated?
If not mitigated, CVE-2016-7038 could allow unauthorized access to user accounts via retained web service tokens.