GitHub Advisoryadvisory · Packagist

GHSA-5282-96ff-xx3h Moodle sensitive information disclosure

MEDIUM Published 2022-05-13 Modified 2023-11-01 Official page ↗
Aliases
CVE-2016-3732
Ecosystem
Packagist
Packages
moodle/moodle
Severity
Moderate
CVSS vector
CVSS:3.0/AV:N/AC:L/PR:L/UI:N/S:U/C:L/I:N/A:N
Weaknesses
CWE-200
Reviewed
2023-07-28

Affected packages

• Packagist moodle/moodle: >= 3.0.0, < 3.0.4 → fixed in 3.0.4 • Packagist moodle/moodle: >= 2.9.0, < 2.9.6 → fixed in 2.9.6 • Packagist moodle/moodle: >= 2.8.0, < 2.8.12 → fixed in 2.8.12 • Packagist moodle/moodle: >= 2.7.0, < 2.7.14 → fixed in 2.7.14

Description

The capability check to access other badges in Moodle 3.0 through 3.0.3, 2.9 through 2.9.5, 2.8 through 2.8.11, 2.7 through 2.7.13, and earlier allows remote authenticated users to read the badges of other users.

Related

Alias · CVE (1)

  • CVE-2016-3732 The capability check to access other badges in Moodle 3.0 through 3.0.3, 2.9 through 2.9.5, 2.8 through 2.8.11, 2.7 through 2.7.13, and… vulnerability

Weakness · CWE (1)

  • CWE-200 Exposure of Sensitive Information to an Unauthorized Actor weakness

References