CVE-2016-2190

MEDIUM

Moodle < 2.6.11, 2.7.x < 2.7.13, 2.8.x < 2.8.11, 2.9.x < 2.9.5, 3.0.x < 3.0.3 - Information Disclosure via Referer Log

Title source: llm
STIX 2.1

Description

Moodle through 2.6.11, 2.7.x before 2.7.13, 2.8.x before 2.8.11, 2.9.x before 2.9.5, and 3.0.x before 3.0.3 does not properly restrict links, which allows remote attackers to obtain sensitive URL information by reading a Referer log.

References (4)

Core 4
Core References
Mailing List mailing-list x_refsource_mlist
http://www.openwall.com/lists/oss-security/2016/03/21/1
Vendor Advisory x_refsource_confirm
https://moodle.org/mod/forum/discuss.php?d=330181
Third Party Advisory, VDB Entry vdb-entry x_refsource_sectrack
http://www.securitytracker.com/id/1035333

Scores

CVSS v3 5.3
EPSS 0.0044
EPSS Percentile 63.2%
Attack Vector NETWORK
CVSS:3.0/AV:N/AC:L/PR:N/UI:N/S:U/C:L/I:N/A:N

Details

CWE
CWE-264
Status published
Products (34)
moodle/moodle 2.7.0
moodle/moodle 2.7.1
moodle/moodle 2.7.2
moodle/moodle 2.7.3
moodle/moodle 2.7.4
moodle/moodle 2.7.5
moodle/moodle 2.7.6
moodle/moodle 2.7.7
moodle/moodle 2.7.8
moodle/moodle 2.7.9
... and 24 more
Published May 22, 2016
Tracked Since Feb 18, 2026