4.3

CVE-2016-2154

admin/tool/monitor/lib.php in Event Monitor in Moodle 2.8.x before 2.8.11, 2.9.x before 2.9.5, and 3.0.x before 3.0.3 does not consider the moodle/course:viewhiddencourses capability, which allows remote authenticated users to discover hidden course names by subscribing to a rule.
Daten sind bereitgestellt durch National Vulnerability Database (NVD)
Moodle ≫ Moodle Version2.8.0
Moodle ≫ Moodle Version2.8.1
Moodle ≫ Moodle Version2.8.2
Moodle ≫ Moodle Version2.8.3
Moodle ≫ Moodle Version2.8.4
Moodle ≫ Moodle Version2.8.5
Moodle ≫ Moodle Version2.8.6
Moodle ≫ Moodle Version2.8.7
Moodle ≫ Moodle Version2.8.8
Moodle ≫ Moodle Version2.8.9
Moodle ≫ Moodle Version2.8.10
Moodle ≫ Moodle Version2.9.0
Moodle ≫ Moodle Version2.9.1
Moodle ≫ Moodle Version2.9.2
Moodle ≫ Moodle Version2.9.3
Moodle ≫ Moodle Version2.9.4
Moodle ≫ Moodle Version3.0.0
Moodle ≫ Moodle Version3.0.1
Moodle ≫ Moodle Version3.0.2
Zu dieser CVE wurde keine Warnung gefunden.
EPSS Metriken
Typ Quelle Score Percentile
EPSS FIRST.org 1.69% 0.741
CVSS Metriken
Quelle Base Score Exploit Score Impact Score Vector String
nvd@nist.gov 4.3 2.8 1.4
CVSS:3.0/AV:N/AC:L/PR:L/UI:N/S:U/C:L/I:N/A:N
nvd@nist.gov 4 8 2.9
AV:N/AC:L/Au:S/C:P/I:N/A:N
CWE-200 Exposure of Sensitive Information to an Unauthorized Actor

The product exposes sensitive information to an actor that is not explicitly authorized to have access to that information.

http://www.openwall.com/lists/oss-security/2016/03/21/1
http://www.securitytracker.com/id/1035333
http://git.moodle.org/gw?p=moodle.git&a=search&h=HEAD&st=commit&s=MDL-51167
https://moodle.org/mod/forum/discuss.php?d=330176
Vendor Advisory