CVE-2016-7038: High severity Moodle moodle vulnerability
Published Jan 20, 2017
·Updated
In Moodle 2.x and 3.x, web service tokens are not invalidated when the user password is changed or forced to be changed.
Affected Software
34 affected componentsFixes available
composer/moodle/moodle>=3.1<3.1.2
3.1.2
composer/moodle/moodle>=3.0<3.0.6
3.0.6
composer/moodle/moodle>=2.9<2.9.8
2.9.8
composer/moodle/moodle>=2.7<2.7.16
2.7.16
Moodle moodle<=2.7.15
Moodle moodle=2.8.0
Moodle moodle=2.8.1
Moodle moodle=2.8.2
Moodle moodle=2.8.3
Moodle moodle=2.8.4
Moodle moodle=2.8.5
Moodle moodle=2.8.6
Moodle moodle=2.8.7
Moodle moodle=2.8.8
Moodle moodle=2.8.9
Moodle moodle=2.8.10
Moodle moodle=2.8.11
Moodle moodle=2.8.12
Moodle moodle=2.9.0
Moodle moodle=2.9.1
Moodle moodle=2.9.2
Moodle moodle=2.9.3
Moodle moodle=2.9.4
Moodle moodle=2.9.5
Moodle moodle=2.9.6
Moodle moodle=2.9.7
Moodle moodle=3.0.0
Moodle moodle=3.0.1
Moodle moodle=3.0.2
Moodle moodle=3.0.3
Moodle moodle=3.0.4
Moodle moodle=3.0.5
Moodle moodle=3.1.0
Moodle moodle=3.1.1
Remediation
Patch Available
Event History
Jan 20, 2017
CVE Published
via MITRE·08:39 AM
Data Sourced
via MITRE·08:39 AM
DescriptionWeakness
Data Sourced
via NVD·08:59 AM
RemedyDescriptionSeverityWeaknessAffected Software
May 13, 2022
Advisory Published
via GitHub·01:12 AM
Frequently Asked Questions
1
What is the severity of CVE-2016-7038?
CVE-2016-7038 is classified as a medium severity vulnerability.
2
How do I fix CVE-2016-7038?
To fix CVE-2016-7038, upgrade to Moodle version 2.7.16, 2.8.12, 2.9.8, or 3.0.6 and above.
3
What exactly does CVE-2016-7038 exploit?
CVE-2016-7038 exploits the vulnerability where web service tokens are not invalidated after a password change.
4
Which versions of Moodle are affected by CVE-2016-7038?
CVE-2016-7038 affects Moodle versions 2.7.15 and below, 2.8.0 to 2.8.11, 2.9.0 to 2.9.7, and 3.0.0 to 3.0.5.
5
What are the risks of CVE-2016-7038 if not mitigated?
If not mitigated, CVE-2016-7038 could allow unauthorized access to user accounts via retained web service tokens.