CVE-2016-8642: Moodle Unauthenticated Access
5.3
CVSS Score
3.0
Basic Information
CVE ID
GHSA ID
EPSS Score
0.44871%
CWE
Published
5/13/2022
Updated
11/2/2023
KEV Status
No
Technology
PHP
Technical Details
CVSS Vector
CVSS:3.0/AV:N/AC:L/PR:N/UI:N/S:U/C:L/I:N/A:N
Package Name | Ecosystem | Vulnerable Versions | First Patched Version |
---|---|---|---|
moodle/moodle | composer | >= 3.1.0, <= 3.1.2 | 3.1.3 |
moodle/moodle | composer | >= 3.0.0, <= 3.0.6 | 3.0.7 |
moodle/moodle | composer | >= 2.9.0, <= 2.9.8 | 2.9.9 |
moodle/moodle | composer | >= 2.8.0, <= 2.8.12 | |
moodle/moodle | composer | >= 2.7.0, <= 2.7.16 | 2.7.17 |
Vulnerability Intelligence
Miggo AI
Root Cause Analysis
The vulnerability stemmed from missing question ID validation in file access checks. The patch adds $args[0] == $this->id validations to:
- Essay question's graderinfo access check
- Base question class's questiontext/generalfeedback handlers
- Combined feedback file checker These missing checks allowed attackers to access files from other questions by manipulating the question ID parameter, bypassing access controls. The commit diff and CWE-284 classification confirm improper access control in these functions.