The "restore teacher" feature in Moodle 3.0 through 3.0.3, 2.9 through 2.9.5, 2.8 through 2.8.11, 2.7 through 2.7.13, and earlier allows remote authenticated users to overwrite the course idnumber.
References
Link | Resource |
---|---|
http://git.moodle.org/gw?p=moodle.git&a=search&h=HEAD&st=commit&s=MDL-51369 | Patch Vendor Advisory |
http://www.openwall.com/lists/oss-security/2016/05/17/4 | Mailing List Third Party Advisory |
http://www.securitytracker.com/id/1035902 | Third Party Advisory VDB Entry |
https://bugzilla.redhat.com/show_bug.cgi?id=1335933 | Issue Tracking Third Party Advisory |
http://git.moodle.org/gw?p=moodle.git&a=search&h=HEAD&st=commit&s=MDL-51369 | Patch Vendor Advisory |
http://www.openwall.com/lists/oss-security/2016/05/17/4 | Mailing List Third Party Advisory |
http://www.securitytracker.com/id/1035902 | Third Party Advisory VDB Entry |
https://bugzilla.redhat.com/show_bug.cgi?id=1335933 | Issue Tracking Third Party Advisory |
Configurations
Configuration 1 (hide)
|
History
No history.
Information
Published : 2017-04-20 21:59
Updated : 2025-04-20 01:37
NVD link : CVE-2016-3733
Mitre link : CVE-2016-3733
CVE.ORG link : CVE-2016-3733
JSON object : View
Products Affected
moodle
- moodle
CWE
CWE-284
Improper Access Control