Vulnerability CVE-2016-3732

Vulnerability Name:

CVE-2016-3732 (CCN-113348)

Assigned:

2016-05-18

Published:

2016-05-18

Updated:

2020-12-01

Summary:

The capability check to access other badges in Moodle 3.0 through 3.0.3, 2.9 through 2.9.5, 2.8 through 2.8.11, 2.7 through 2.7.13, and earlier allows remote authenticated users to read the badges of other users.

CVSS v3 Severity:

4.3 Medium (CVSS v3.1 Vector: CVSS:3.1/AV:N/AC:L/PR:L/UI:N/S:U/C:L/I:N/A:N)
3.8 Low (Temporal CVSS v3.1 Vector: CVSS:3.1/AV:N/AC:L/PR:L/UI:N/S:U/C:L/I:N/A:N/E:U/RL:O/RC:C)

Exploitability Metrics:	Attack Vector (AV): Network Attack Complexity (AC): Low Privileges Required (PR): Low User Interaction (UI): None
Scope:	Scope (S): Unchanged
Impact Metrics:	Confidentiality (C): Low Integrity (I): None Availibility (A): None

4.3 Medium (CCN CVSS v3.1 Vector: CVSS:3.1/AV:N/AC:L/PR:L/UI:N/S:U/C:N/I:L/A:N)
3.8 Low (CCN Temporal CVSS v3.1 Vector: CVSS:3.1/AV:N/AC:L/PR:L/UI:N/S:U/C:N/I:L/A:N/E:U/RL:O/RC:C)

Exploitability Metrics:	Attack Vector (AV): Network Attack Complexity (AC): Low Privileges Required (PR): Low User Interaction (UI): None
Scope:	Scope (S): Unchanged
Impact Metrics:	Confidentiality (C): None Integrity (I): Low Availibility (A): None

CVSS v2 Severity:

4.0 Medium (CVSS v2 Vector: AV:N/AC:L/Au:S/C:P/I:N/A:N)

Exploitability Metrics:	Access Vector (AV): Network Access Complexity (AC): Low Authentication (Au): Single_Instance
Impact Metrics:	Confidentiality (C): Partial Integrity (I): None Availibility (A): None

4.0 Medium (CCN CVSS v2 Vector: AV:N/AC:L/Au:S/C:N/I:P/A:N)

Exploitability Metrics:	Access Vector (AV): Network Access Complexity (AC): Low Athentication (Au): Single_Instance
Impact Metrics:	Confidentiality (C): None Integrity (I): Partial Availibility (A): None

Vulnerability Type:

CWE-200

Vulnerability Consequences:

Bypass Security

References:

Source: MITRE
Type: CNA
CVE-2016-3732

Source: CCN
Type: SECTRACK ID: 1035902
Moodle Bugs Let Remote Users Access and Modify Data and Conduct Cross-Site Request Forgery Attacks

Source: MLIST
Type: Mailing List, Third Party Advisory
[oss-security] 20160517 Moodle security release 3.0.4, 2.9.6, 2.8.12, 2.7.14

Source: SECTRACK
Type: Third Party Advisory, VDB Entry
1035902

Source: CONFIRM
Type: Issue Tracking, Third Party Advisory
https://bugzilla.redhat.com/show_bug.cgi?id=1335933

Source: XF
Type: UNKNOWN
moodle-cve20163732-sec-bypass(113348)

Source: CCN
Type: Moodle Security Advisory MSA-16-0016
User can view badges of other users without proper permissions

Vulnerable Configuration:

Configuration 1:

cpe:/a:moodle:moodle:2.7.4:*:*:*:*:*:*:*

OR cpe:/a:moodle:moodle:2.7.5:*:*:*:*:*:*:*

OR cpe:/a:moodle:moodle:2.7.6:*:*:*:*:*:*:*

OR cpe:/a:moodle:moodle:2.7.7:*:*:*:*:*:*:*

OR cpe:/a:moodle:moodle:2.8.9:*:*:*:*:*:*:*

OR cpe:/a:moodle:moodle:2.8.10:*:*:*:*:*:*:*

OR cpe:/a:moodle:moodle:2.8.11:*:*:*:*:*:*:*

OR cpe:/a:moodle:moodle:2.8.0:*:*:*:*:*:*:*

OR cpe:/a:moodle:moodle:3.0.0:rc4:*:*:*:*:*:*

OR cpe:/a:moodle:moodle:3.0.1:*:*:*:*:*:*:*

OR cpe:/a:moodle:moodle:3.0.2:*:*:*:*:*:*:*

OR cpe:/a:moodle:moodle:2.7.0:-:*:*:*:*:*:*

OR cpe:/a:moodle:moodle:2.7.0:beta:*:*:*:*:*:*

OR cpe:/a:moodle:moodle:2.7.0:rc1:*:*:*:*:*:*

OR cpe:/a:moodle:moodle:2.7.12:*:*:*:*:*:*:*

OR cpe:/a:moodle:moodle:2.7.13:*:*:*:*:*:*:*

OR cpe:/a:moodle:moodle:2.8.2:*:*:*:*:*:*:*

OR cpe:/a:moodle:moodle:2.8.3:*:*:*:*:*:*:*

OR cpe:/a:moodle:moodle:2.8.4:*:*:*:*:*:*:*

OR cpe:/a:moodle:moodle:2.9.3:*:*:*:*:*:*:*

OR cpe:/a:moodle:moodle:2.9.4:*:*:*:*:*:*:*

OR cpe:/a:moodle:moodle:2.9.5:*:*:*:*:*:*:*

OR cpe:/a:moodle:moodle:3.0.3:*:*:*:*:*:*:*

OR cpe:/a:moodle:moodle:2.7.1:*:*:*:*:*:*:*

OR cpe:/a:moodle:moodle:2.7.3:*:*:*:*:*:*:*

OR cpe:/a:moodle:moodle:2.7.8:*:*:*:*:*:*:*

OR cpe:/a:moodle:moodle:2.7.10:*:*:*:*:*:*:*

OR cpe:/a:moodle:moodle:2.8.5:*:*:*:*:*:*:*

OR cpe:/a:moodle:moodle:2.8.7:*:*:*:*:*:*:*

OR cpe:/a:moodle:moodle:2.9.0:*:*:*:*:*:*:*

OR cpe:/a:moodle:moodle:2.9.2:*:*:*:*:*:*:*

OR cpe:/a:moodle:moodle:3.0:*:*:*:*:*:*:*

OR cpe:/a:moodle:moodle:3.0.0:rc1:*:*:*:*:*:*

OR cpe:/a:moodle:moodle:3.0.0:rc3:*:*:*:*:*:*

OR cpe:/a:moodle:moodle:2.7.0:rc2:*:*:*:*:*:*

OR cpe:/a:moodle:moodle:2.7.2:*:*:*:*:*:*:*

OR cpe:/a:moodle:moodle:2.7.9:*:*:*:*:*:*:*

OR cpe:/a:moodle:moodle:2.7.11:*:*:*:*:*:*:*

OR cpe:/a:moodle:moodle:2.8.6:*:*:*:*:*:*:*

OR cpe:/a:moodle:moodle:2.8.8:*:*:*:*:*:*:*

OR cpe:/a:moodle:moodle:2.8.1:*:*:*:*:*:*:*

OR cpe:/a:moodle:moodle:2.9.1:*:*:*:*:*:*:*

OR cpe:/a:moodle:moodle:3.0.0:beta:*:*:*:*:*:*

OR cpe:/a:moodle:moodle:3.0.0:rc2:*:*:*:*:*:*

Configuration CCN 1:

cpe:/a:moodle:moodle:3.0.0:-:*:*:*:*:*:*