#VU40270 Information disclosure in Moodle - CVE-2016-2158

Vulnerability identifier: #VU40270

Vulnerability risk: Low

CVSSv4.0: 1.3 [CVSS:4.0/AV:N/AC:L/AT:N/PR:L/UI:N/VC:L/VI:N/VA:N/SC:N/SI:N/SA:N/E:U/U:Clear]

CVE-ID: CVE-2016-2158

CWE-ID: CWE-200

Exploitation vector: Network

Exploit availability: No

Vulnerable software:
Moodle
Web applications / Other software

Vendor: moodle.org

Description

The vulnerability allows a remote authenticated user to gain access to sensitive information.

lib/ajax/getnavbranch.php in Moodle through 2.6.11, 2.7.x before 2.7.13, 2.8.x before 2.8.11, 2.9.x before 2.9.5, and 3.0.x before 3.0.3, when the forcelogin feature is enabled, allows remote attackers to obtain sensitive category-detail information from the navigation branch by leveraging the guest role for an Ajax request.

Mitigation
Install update from vendor's website.

Vulnerable software versions

Moodle: 2.7 - 2.7.12, 2.8 - 2.8.10, 2.9 - 2.9.4, 3.0 - 3.0.2

---

External links
https://git.moodle.org/gw?p=moodle.git&a=search&h=HEAD&st=commit&s=MDL-52774
https://www.openwall.com/lists/oss-security/2016/03/21/1
https://www.securitytracker.com/id/1035333
https://moodle.org/mod/forum/discuss.php?d=330180

---

Q & A

Can this vulnerability be exploited remotely?

Yes. This vulnerability can be exploited by a remote authenticated user via the Internet.

Is there known malware, which exploits this vulnerability?

No. We are not aware of malware exploiting this vulnerability.