medium5.4
CVE-2016-5014
Moodle sensitive information disclosure
Impact
In Moodle 2.x and 3.x, an unenrolled user still receives event monitor notifications even though they can no longer access the course.
Affected packages
| Ecosystem | Package | Affected | Fixed in |
|---|---|---|---|
| composer | moodle/moodle | = 3.1.0 | 3.1.1 |
Affected products
| Vendor | Product | Affected versions |
|---|---|---|
| Moodle | Moodle | Versions 2.8.0, 2.8.1, 2.8.2, 2.8.3, 2.8.4, 2.8.5 |
Weakness classification
References
- NVD record
- CVE.org record
- GitHub advisory
- http://www.securityfocus.com/bid/92042
- https://moodle.org/mod/forum/discuss.php?d=336699
- https://github.com/advisories/GHSA-c4cq-v4wp-28hg
- https://nvd.nist.gov/vuln/detail/CVE-2016-5014
- https://github.com/moodle/moodle/commit/ea106d2a1dbc633a22f12a119763b2af5f33542b
- https://web.archive.org/web/20210123154548/http://www.securityfocus.com/bid/92042