CVE-2016-2190

MEDIUM

Moodle < 2.6.11 - Access Control

Title source: rule

Description

Moodle through 2.6.11, 2.7.x before 2.7.13, 2.8.x before 2.8.11, 2.9.x before 2.9.5, and 3.0.x before 3.0.3 does not properly restrict links, which allows remote attackers to obtain sensitive URL information by reading a Referer log.

References (4)

[Patch] http://git.moodle.org/gw?p=moodle.git&a=search&h=HEAD&st=commit&s=MDL-52651

[Third Party Advisory, VDB Entry] http://www.securitytracker.com/id/1035333

[Vendor Advisory] https://moodle.org/mod/forum/discuss.php?d=330181

[Mailing List] http://www.openwall.com/lists/oss-security/2016/03/21/1

Scores

CVSS v3 5.3

EPSS 0.0044

EPSS Percentile 62.8%

Attack Vector NETWORK

CVSS:3.0/AV:N/AC:L/PR:N/UI:N/S:U/C:L/I:N/A:N

Classification

CWE

CWE-264

Status draft

Affected Products (34)

moodle/moodle < 2.6.11

moodle/moodle

... and 19 more

Timeline

Published May 22, 2016

Tracked Since Feb 18, 2026