The (1) core_enrol_get_course_enrolment_methods and (2) enrol_self_get_instance_info web services in Moodle through 2.6.11, 2.7.x before 2.7.12, 2.8.x before 2.8.10, 2.9.x before 2.9.4, and 3.0.x before 3.0.2 do not consider the moodle/course:viewhiddencourses capability, which allows remote authenticated users to obtain sensitive information via a web-service request.

There are packages installed that are affected by a vulnerability referenced in the following CVE:

  - The (1) core_enrol_get_course_enrolment_methods and (2) enrol_self_get_instance_info web services in
    Moodle through 2.6.11, 2.7.x before 2.7.12, 2.8.x before 2.8.10, 2.9.x before 2.9.4, and 3.0.x before
    3.0.2 do not consider the moodle/course:viewhiddencourses capability, which allows remote authenticated
    users to obtain sensitive information via a web-service request. (CVE-2016-0724)

Security update.

Note that Tenable Network Security has extracted the preceding description block directly from the Fedora security advisory. Tenable has attempted to automatically clean and format it as much as possible without introducing additional issues.

Marina Glancy reports :

- MSA-16-0001: Two enrolment-related web services don't check course visibility

- MSA-16-0002: XSS Vulnerability in course management search

ID	Name	Product	Family	Severity
434104	SCA: security update for moodle/moodle (GHSA-hjrj-7wcj-7j3c)	Tenable Cloud Security	SCA Checks	medium
434104	SCA: security update for moodle/moodle (GHSA-hjrj-7wcj-7j3c)	Tenable Self-Hosted Container Security	SCA Checks	medium
89645	Fedora 22 : moodle-2.8.10-1.fc22 (2016-fb2597f4eb)	Nessus	Fedora Local Security Checks	medium
89489	Fedora 23 : moodle-2.9.4-1.fc23 (2016-1c10ab3c35)	Nessus	Fedora Local Security Checks	medium
89007	FreeBSD : moodle -- multiple vulnerabilities (2d299950-ddb0-11e5-8fa8-14dae9d210b8)	Nessus	FreeBSD Local Security Checks	medium

Detections

Analytics

CVE-2016-0724

medium

Tenable Plugins

medium

medium

medium

medium

medium