CVE-2016-8642: Medium severity Moodle moodle vulnerability
Published Jan 20, 2017
·Updated
In Moodle 2.x and 3.x, the question engine allows access to files that should not be available.
Affected Software
38 affected componentsFixes available
composer/moodle/moodle>=2.7.0<=2.7.16
2.7.17
composer/moodle/moodle>=2.8.0<=2.8.12
composer/moodle/moodle>=2.9.0<=2.9.8
2.9.9
composer/moodle/moodle>=3.0.0<=3.0.6
3.0.7
composer/moodle/moodle>=3.1.0<=3.1.2
3.1.3
Moodle moodle<=2.7.16
Moodle moodle=2.8.0
Moodle moodle=2.8.1
Moodle moodle=2.8.2
Moodle moodle=2.8.3
Moodle moodle=2.8.4
Moodle moodle=2.8.5
Moodle moodle=2.8.6
Moodle moodle=2.8.7
Moodle moodle=2.8.8
Moodle moodle=2.8.9
Moodle moodle=2.8.10
Moodle moodle=2.8.11
Moodle moodle=2.8.12
Moodle moodle=2.9.0
Moodle moodle=2.9.1
Moodle moodle=2.9.2
Moodle moodle=2.9.3
Moodle moodle=2.9.4
Moodle moodle=2.9.5
Moodle moodle=2.9.6
Moodle moodle=2.9.7
Moodle moodle=2.9.8
Moodle moodle=3.0.0
Moodle moodle=3.0.1
Moodle moodle=3.0.2
Moodle moodle=3.0.3
Moodle moodle=3.0.4
Moodle moodle=3.0.5
Moodle moodle=3.0.6
Moodle moodle=3.1.0
Moodle moodle=3.1.1
Moodle moodle=3.1.2
Remediation
Patch Available
Event History
Jan 20, 2017
CVE Published
via MITRE·08:39 AM
Data Sourced
via MITRE·08:39 AM
DescriptionWeakness
Data Sourced
via NVD·08:59 AM
RemedyDescriptionSeverityWeaknessAffected Software
May 13, 2022
Advisory Published
01:12 AM
Frequently Asked Questions
1
What is CVE-2016-8642?
CVE-2016-8642 is a vulnerability in Moodle versions 2.x and 3.x where the question engine improperly allows access to restricted files.
2
What severity level is associated with CVE-2016-8642?
CVE-2016-8642 has been rated as a medium severity vulnerability.
3
How do I fix CVE-2016-8642?
To fix CVE-2016-8642, it is recommended to upgrade Moodle to the latest version where the vulnerability has been addressed.
4
Which versions of Moodle are affected by CVE-2016-8642?
CVE-2016-8642 affects Moodle versions 2.7.16 and earlier, and specific 2.8.x versions up to 2.9.8.
5
Is CVE-2016-8642 easy to exploit?
CVE-2016-8642 can be exploited by attackers who have certain access levels, making it a significant risk if proper access controls are not enforced.