GitHub Advisoryadvisory · Packagist

GHSA-gr8j-qm8r-rfgg Moodle Improper Access Control

MEDIUM Published 2022-05-13 Modified 2024-01-26 Official page ↗
Aliases
CVE-2016-3733
Ecosystem
Packagist
Packages
moodle/moodle
Severity
Moderate
CVSS vector
CVSS:3.0/AV:N/AC:L/PR:L/UI:N/S:U/C:N/I:L/A:N
Weaknesses
CWE-284
Reviewed
2024-01-26

Affected packages

• Packagist moodle/moodle: >= 2.7, < 2.7.14 → fixed in 2.7.14 • Packagist moodle/moodle: >= 2.8, < 2.8.12 → fixed in 2.8.12 • Packagist moodle/moodle: >= 2.9, < 2.9.6 → fixed in 2.9.6 • Packagist moodle/moodle: >= 3.0, < 3.0.4 → fixed in 3.0.4

Description

The "restore teacher" feature in Moodle 3.0 through 3.0.3, 2.9 through 2.9.5, 2.8 through 2.8.11, 2.7 through 2.7.13, and earlier allows remote authenticated users to overwrite the course idnumber.

Related

Alias · CVE (1)

  • CVE-2016-3733 The "restore teacher" feature in Moodle 3.0 through 3.0.3, 2.9 through 2.9.5, 2.8 through 2.8.11, 2.7 through 2.7.13, and earlier allows… vulnerability

Weakness · CWE (1)

  • CWE-284 Improper Access Control weakness

References