medium6.5
CVE-2016-3729
Moodle Improper Access Control
Impact
The user editing form in Moodle 3.0 through 3.0.3, 2.9 through 2.9.5, 2.8 through 2.8.11, 2.7 through 2.7.13, and earlier allows remote authenticated users to edit profile fields locked by the administrator.
Affected packages
| Ecosystem | Package | Affected | Fixed in |
|---|---|---|---|
| composer | moodle/moodle | >= 3.0, < 3.0.3 | 3.0.3 |
Affected products
| Vendor | Product | Affected versions |
|---|---|---|
| Moodle | Moodle | Versions 2.7.0, 2.7.1, 2.7.2, 2.7.3, 2.7.4, 2.7.5 |