CVE-2016-2156: Moodle - Calendar Event Data Leakage
Summary
CVE-2016-2156: Moodle provides calendar-event data without considering whether an activity is hidden. Affects moodle/moodle across 4 version ranges.
< 2.7.13
>= 2.8.0, < 2.8.11
>= 2.9.0, < 2.9.5
>= 3.0.0, < 3.0.3
Fixed in 4 releases; the minimum fixed version depends on the release line you run. How to fix ↓
Check if this vulnerability affects your application
Upload a manifest or SBOM and we'll show whether you're affected, plus every other risky package in the same scan.
No signup required · Results in about 60 seconds
Background
Moodle is an open-source learning management system (LMS) widely used for creating and managing online courses. It provides various features, including a calendar module that allows users to schedule and manage events. However, a vulnerability in Moodle versions 2.6.11 through 3.0.3 exposes calendar-event data without considering whether an activity is hidden. This vulnerability can be exploited by remote authenticated users to obtain sensitive information via a web-service request.
Vulnerability Detail
The vulnerability in Moodle arises from the calendar/externallib.php file, which fails to check whether an activity is hidden before providing calendar-event data. As a result, authenticated users can access sensitive information that should be hidden from them. This can lead to the exposure of confidential data, such as event details, participant information, and other related data. The impact of this vulnerability is considered moderate, with a CVSS score of 4.3.
How To Fix
Fixed versions by release line
The minimum fixed version depends on the release line you run.
-
< 2.7.132.7.13composer require moodle/moodle:2.7.13 -
>= 2.8.0, < 2.8.112.8.11composer require moodle/moodle:2.8.11 -
>= 2.9.0, < 2.9.52.9.5composer require moodle/moodle:2.9.5 -
>= 3.0.0, < 3.0.33.0.3composer require moodle/moodle:3.0.3
Tip — Not sure which release line you're on? Vulert can find the fix for the version you are using. Scan free →
Workaround
There is no specific workaround mentioned for this vulnerability. It is advised to apply the recommended fix by updating Moodle to the fixed versions.
Conclusion
The vulnerability in Moodle versions 2.6.11 through 3.0.3 exposes calendar-event data without considering whether an activity is hidden. This can lead to the leakage of sensitive information to authenticated users. It is crucial to update Moodle to the fixed versions to mitigate this vulnerability. For further support on vulnerability remediation, you can reach out to DevNack.com.
See every vulnerability recorded for moodle/moodle →
FAQ
Moodle is an open-source learning management system (LMS) used for creating and managing online courses.
The vulnerability allows authenticated users to access sensitive calendar-event data that should be hidden, potentially exposing confidential information.
To fix this vulnerability, update Moodle to the fixed versions: 2.7.13, 2.8.11, 2.9.5, or 3.0.3.
No specific workaround has been provided. It is recommended to apply the fix by updating Moodle.
The vulnerability is considered moderate, with a CVSS score of 4.3.
References
Related vulnerabilities
Recent vulnerabilities recorded for moodle/moodle.
