CVSS: 4.3EPSS: 0%CPEs: 19EXPL: 0CVE-2016-2155
https://notcve.org/view.php?id=CVE-2016-2155
The grade-reporting feature in Singleview (aka Single View) in Moodle 2.8.x before 2.8.11, 2.9.x before 2.9.5, and 3.0.x before 3.0.3 does not consider the moodle/grade:manage capability, which allows remote authenticated users to modify "Exclude grade" settings by leveraging the Non-Editing Instructor role. La funcionalidad grade-reporting en Singleview (también conocida como Single View) en Moodle 2.8.x en versiones anteriores a 2.8.11, 2.9.x en versiones anteriores a 2.9.5 y 3.0.x en versiones anteriores a 3.0.3 no considera la capacidad moodle/grade:manage, lo que permite a usuarios remotos autenticados modificar ajustes "Exclude grade" aprovechando el rol Non-Editing Instructor. • http://git.moodle.org/gw?p=moodle.git&a=search&h=HEAD&st=commit&s=MDL-52378 http://www.openwall.com/lists/oss-security/2016/03/21/1 http://www.securitytracker.com/id/1035333 https://moodle.org/mod/forum/discuss.php?d=330177 • CWE-264: Permissions, Privileges, and Access Controls •
CVSS: 4.3EPSS: 0%CPEs: 33EXPL: 0CVE-2016-2151
https://notcve.org/view.php?id=CVE-2016-2151
user/index.php in Moodle through 2.6.11, 2.7.x before 2.7.13, 2.8.x before 2.8.11, 2.9.x before 2.9.5, and 3.0.x before 3.0.3 grants excessive authorization on the basis of the moodle/course:viewhiddenuserfields capability, which allows remote authenticated users to discover student e-mail addresses by leveraging the teacher role and reading a Participants list. user/index.php en Moodle hasta la versión 2.6.11, 2.7.x en versiones anteriores a 2.7.13, 2.8.x en versiones anteriores a 2.8.11, 2.9.x en versiones anteriores a 2.9.5 y 3.0.x en versiones anteriores a 3.0.3 concede excesiva autorización sobre la base de la capacidad de moodle/course:viewhiddenuserfields, lo que permite a usuarios remotos autenticados descubrir direcciones e-mail de estudiantes aprovechando el rol de profesor y leyendo una lista Participants. • http://git.moodle.org/gw?p=moodle.git&a=search&h=HEAD&st=commit&s=MDL-52433 http://www.openwall.com/lists/oss-security/2016/03/21/1 http://www.securitytracker.com/id/1035333 https://moodle.org/mod/forum/discuss.php?d=330173 • CWE-200: Exposure of Sensitive Information to an Unauthorized Actor •
CVSS: 4.3EPSS: 0%CPEs: 19EXPL: 0CVE-2016-2154
https://notcve.org/view.php?id=CVE-2016-2154
admin/tool/monitor/lib.php in Event Monitor in Moodle 2.8.x before 2.8.11, 2.9.x before 2.9.5, and 3.0.x before 3.0.3 does not consider the moodle/course:viewhiddencourses capability, which allows remote authenticated users to discover hidden course names by subscribing to a rule. admin/tool/monitor/lib.php en Event Monitor en Moodle 2.8.x en versiones anteriores a 2.8.11, 2.9.x en versiones anteriores a 2.9.5 y 3.0.x en versiones anteriores a 3.0.3 no considera la capacidad moodle/course:viewhiddencourses, lo que permite a usuarios remotos autenticados descubrir el nombre de cursos ocultos suscribiéndose a una regla. • http://git.moodle.org/gw?p=moodle.git&a=search&h=HEAD&st=commit&s=MDL-51167 http://www.openwall.com/lists/oss-security/2016/03/21/1 http://www.securitytracker.com/id/1035333 https://moodle.org/mod/forum/discuss.php?d=330176 • CWE-200: Exposure of Sensitive Information to an Unauthorized Actor •
CVSS: 4.3EPSS: 0%CPEs: 33EXPL: 0CVE-2016-2156
https://notcve.org/view.php?id=CVE-2016-2156
calendar/externallib.php in Moodle through 2.6.11, 2.7.x before 2.7.13, 2.8.x before 2.8.11, 2.9.x before 2.9.5, and 3.0.x before 3.0.3 provides calendar-event data without considering whether an activity is hidden, which allows remote authenticated users to obtain sensitive information via a web-service request. alendar/externallib.php en Moodle hasta la versión 2.6.11, 2.7.x en versiones anteriores a 2.7.13, 2.8.x en versiones anteriores a 2.8.11, 2.9.x en versiones anteriores a 2.9.5 y 3.0.x en versiones anteriores a 3.0.3 proporciona datos de eventos de calendario sin tener en cuenta si una actividad está oculta, lo que permite a usuarios remotos autenticados obtener información sensible a través de una petición de servicio web. • http://git.moodle.org/gw?p=moodle.git&a=search&h=HEAD&st=commit&s=MDL-52808 http://www.openwall.com/lists/oss-security/2016/03/21/1 http://www.securitytracker.com/id/1035333 https://moodle.org/mod/forum/discuss.php?d=330178 • CWE-200: Exposure of Sensitive Information to an Unauthorized Actor •
CVSS: 8.8EPSS: 0%CPEs: 33EXPL: 0CVE-2016-2157
https://notcve.org/view.php?id=CVE-2016-2157
Cross-site request forgery (CSRF) vulnerability in mod/assign/adminmanageplugins.php in Moodle through 2.6.11, 2.7.x before 2.7.13, 2.8.x before 2.8.11, 2.9.x before 2.9.5, and 3.0.x before 3.0.3 allows remote attackers to hijack the authentication of administrators for requests that manage Assignment plugins. Vulnerabilidad de CSRF en mod/assign/adminmanageplugins.php en Moodle hasta la versión 2.6.11, 2.7.x en versiones anteriores a 2.7.13, 2.8.x en versiones anteriores a 2.8.11, 2.9.x en versiones anteriores a 2.9.5 y 3.0.x en versiones anteriores a 3.0.3 permite a atacantes remotos secuestrar la autenticación de administradores para peticiones que manejan plugins Assignment. • http://git.moodle.org/gw?p=moodle.git&a=search&h=HEAD&st=commit&s=MDL-53031 http://www.openwall.com/lists/oss-security/2016/03/21/1 http://www.securitytracker.com/id/1035333 https://moodle.org/mod/forum/discuss.php?d=330179 • CWE-352: Cross-Site Request Forgery (CSRF) •