CVE-2016-3729: Moodle Improper Access Control
Summary
CVE-2016-3729: Moodle Improper Access Control. Affects moodle/moodle across 4 version ranges.
>= 2.7, < 2.7.14
>= 2.8, < 2.8.12
>= 2.9, < 2.9.6
>= 3.0, < 3.0.3
Fixed in 4 releases; the minimum fixed version depends on the release line you run. How to fix ↓
Check if this vulnerability affects your application
Upload a manifest or SBOM and we'll show whether you're affected, plus every other risky package in the same scan.
No signup required · Results in about 60 seconds
Background
Moodle is an open-source learning management system (LMS) used for creating and delivering online courses. It provides a platform for educators to create interactive and collaborative learning environments. Moodle is widely adopted by educational institutions and organizations around the world. However, versions 3.0 through 3.0.3, 2.9 through 2.9.5, 2.8 through 2.8.11, 2.7 through 2.7.13, and earlier are vulnerable to an improper access control issue.
Vulnerability Detail
The vulnerability in Moodle allows remote authenticated users to edit profile fields that are locked by the administrator. This means that users with authenticated access can modify profile fields that should be restricted. This can lead to unauthorized changes to user profiles and potential misuse of user data. The vulnerability is rated as moderate with a CVSS score of 6.5.
How To Fix
Fixed versions by release line
The minimum fixed version depends on the release line you run.
-
>= 2.7, < 2.7.142.7.14composer require moodle/moodle:2.7.14 -
>= 2.8, < 2.8.122.8.12composer require moodle/moodle:2.8.12 -
>= 2.9, < 2.9.62.9.6composer require moodle/moodle:2.9.6 -
>= 3.0, < 3.0.33.0.3composer require moodle/moodle:3.0.3
Tip — Not sure which release line you're on? Vulert can find the fix for the version you are using. Scan free →
Workaround
There is no known workaround for this vulnerability. It is recommended to apply the official patches or upgrade to the fixed versions of Moodle.
Conclusion
The improper access control vulnerability in Moodle can allow authenticated users to edit locked profile fields, potentially leading to unauthorized changes and misuse of user data. It is crucial to upgrade to the patched versions of Moodle or apply the official patches to mitigate this vulnerability. For further support on vulnerability remediation, please contact DevNack.com.
See every vulnerability recorded for moodle/moodle →
FAQ
Moodle is an open-source learning management system used for creating and delivering online courses.
Versions 3.0 through 3.0.3, 2.9 through 2.9.5, 2.8 through 2.8.11, 2.7 through 2.7.13, and earlier are affected.
The vulnerability allows authenticated users to edit locked profile fields, potentially leading to unauthorized changes to user profiles and misuse of user data.
To fix this vulnerability, upgrade to the patched versions of Moodle (3.0.3 or later for version 3.0, 2.9.6 or later for version 2.9, 2.8.12 or later for version 2.8, 2.7.14 or later for version 2.7).
There is no known workaround for this vulnerability. It is recommended to apply the official patches or upgrade to the fixed versions of Moodle.
Related vulnerabilities
Recent vulnerabilities recorded for moodle/moodle.
