CVE-2016-8642: Moodle Unauthenticated Access
In Moodle 2.x and 3.x, the question engine allows access to files that should not be available.
Affected Software
Remediation
Recommended actions to resolve this vulnerability, in priority order.
- Upgrade
Upgrade
composer/moodle/moodleto a version that resolves this vulnerability.Fixed in 2.7.17 - Upgrade
Upgrade
composer/moodle/moodleto a version that resolves this vulnerability.Fixed in 2.9.9 - Upgrade
Upgrade
composer/moodle/moodleto a version that resolves this vulnerability.Fixed in 3.0.7 - Upgrade
Upgrade
composer/moodle/moodleto a version that resolves this vulnerability.Fixed in 3.1.3
Event History
Frequently Asked Questions
What is CVE-2016-8642?
CVE-2016-8642 is a vulnerability in Moodle versions 2.x and 3.x where the question engine improperly allows access to restricted files.
What severity level is associated with CVE-2016-8642?
CVE-2016-8642 has been rated as a medium severity vulnerability.
How do I fix CVE-2016-8642?
To fix CVE-2016-8642, it is recommended to upgrade Moodle to the latest version where the vulnerability has been addressed.
Which versions of Moodle are affected by CVE-2016-8642?
CVE-2016-8642 affects Moodle versions 2.7.16 and earlier, and specific 2.8.x versions up to 2.9.8.
Is CVE-2016-8642 easy to exploit?
CVE-2016-8642 can be exploited by attackers who have certain access levels, making it a significant risk if proper access controls are not enforced.