CVE-2016-3732: Exposure of Sensitive Information to an Unauthorized Actor

May 13, 2022 (updated July 28, 2023)

The capability check to access other badges in Moodle 3.0 through 3.0.3, 2.9 through 2.9.5, 2.8 through 2.8.11, 2.7 through 2.7.13, and earlier allows remote authenticated users to read the badges of other users.

References

www.openwall.com/lists/oss-security/2016/05/17/4
bugzilla.redhat.com/show_bug.cgi?id=1335933
github.com/advisories/GHSA-5282-96ff-xx3h
nvd.nist.gov/vuln/detail/CVE-2016-3732
web.archive.org/web/20210413170947/http://www.securitytracker.com/id/1035902

Detect and mitigate CVE-2016-3732 with GitLab Dependency Scanning

Secure your software supply chain by verifying that all open source dependencies used in your projects contain no disclosed vulnerabilities. Learn more about Dependency Scanning →