GitHub Advisoryadvisory · Packagist

GHSA-r9pc-g29w-f86j Moodle sensitive information disclosure

MEDIUM Published 2022-05-13 Modified 2023-12-07 Official page ↗
Aliases
CVE-2016-2190
Ecosystem
Packagist
Packages
moodle/moodle
Severity
Moderate
CVSS vector
CVSS:3.0/AV:N/AC:L/PR:N/UI:N/S:U/C:L/I:N/A:N
Reviewed
2023-07-28

Affected packages

• Packagist moodle/moodle: <= 2.6.11 (no fix yet) • Packagist moodle/moodle: >= 2.7.0, < 2.7.13 → fixed in 2.7.13 • Packagist moodle/moodle: >= 2.8.0, < 2.8.11 → fixed in 2.8.11 • Packagist moodle/moodle: >= 2.9.0, < 2.9.5 → fixed in 2.9.5 • Packagist moodle/moodle: >= 3.0.0, < 3.0.3 → fixed in 3.0.3

Description

Moodle through 2.6.11, 2.7.x before 2.7.13, 2.8.x before 2.8.11, 2.9.x before 2.9.5, and 3.0.x before 3.0.3 does not properly restrict links, which allows remote attackers to obtain sensitive URL information by reading a Referer log.

Related

Alias · CVE (1)

  • CVE-2016-2190 Moodle through 2.6.11, 2.7.x before 2.7.13, 2.8.x before 2.8.11, 2.9.x before 2.9.5, and 3.0.x before 3.0.3 does not properly restrict… vulnerability

References