The remote web server hosts Moodle, an open-source course management system.  Versions of Moodle 2.7.x prior to 2.7.14 are exposed to the following vulnerabilities :

 - A flaw exists that may allow an attacker to have an unspecified impact.  No further details have been provided by the vendor.
 - A flaw exists that is due to the user editing form only disabling the profile fields in the UI and failing to restrict users from editing them.  This may allow an authenticated remote attacker to make changes to profiles. (CVE-2016-3729)
 - A flaw exists in the 'badges/lib.php' script that is triggered as capability checks to view other badges are performed for the current user instead for the user whose badges are being viewed.  This may allow an authenticated remote attacker to gain access to potentially sensitive information. (CVE-2016-3732)
 - A flaw exists in the 'backup/moodle2/restore_stepslib.php' script that may allow an authenticated remote attacker to overwrite the course ID number without having the proper authorization to do so. (CVE-2016-3733)
 - A flaw exists as HTTP requests to 'mod/forum/markposts.php' do not require multiple steps, explicit confirmation, or a unique token when performing certain sensitive actions.  By tricking a user into following a specially crafted link, a context-dependent attacker can perform a Cross-Site Request Forgery (CSRF / XSRF) attack causing the victim to mark a forum post as read. (CVE-2016-3734)

The remote web server hosts Moodle, an open-source course management system.  Versions of Moodle 2.8.x prior to 2.8.12, 2.9.x prior to 2.9.6 or 3.0.x prior to 3.0.4 are exposed to the following vulnerabilities :

 - A flaw exists that may allow an attacker to have an unspecified impact.  No further details have been provided by the vendor.
 - A flaw exists that is due to the user editing form only disabling the profile fields in the UI and failing to restrict users from editing them.  This may allow an authenticated remote attacker to make changes to profiles.
 - A flaw exists in the subscription page that is triggered during the handling of overly verbose error messages.  This may allow a remote attacker to gain access to the name of inaccessible forums or forum discussions.
 - A flaw exists in the 'badges/lib.php' script that is triggered as capability checks to view other badges are performed for the current user instead for the user whose badges are being viewed.  This may allow an authenticated remote attacker to gain access to potentially sensitive information.
 - A flaw exists in the 'backup/moodle2/restore_stepslib.php' script that may allow an authenticated remote attacker to overwrite the course ID number without having the proper authorization to do so.
 - A flaw exists as HTTP requests to 'mod/forum/markposts.php' do not require multiple steps, explicit confirmation, or a unique token when performing certain sensitive actions.  By tricking a user into following a specially crafted link, a context-dependent attacker can perform a Cross-Site Request Forgery (CSRF / XSRF) attack causing the victim to mark a forum post as read.

There are packages installed that are affected by a vulnerability referenced in the following CVE:

  - The capability check to access other badges in Moodle 3.0 through 3.0.3, 2.9 through 2.9.5, 2.8 through
    2.8.11, 2.7 through 2.7.13, and earlier allows remote authenticated users to read the badges of other
    users. (CVE-2016-3732)

Linux/Unix 主機上安裝了一個或多個受到弱點影響的套件，且廠商未提供可用的修補程式。

  - 在 Moodle 3.0 至 3.0.3、 2.9 至 2.9.5、 2.8 至 2.8.11、 2.7 至 2.7.13及更舊版本中用於存取其他徽章的功能檢查允許經驗證的遠端使用者讀取其他使用者的徽章。 (CVE-2016-3732)

請注意，Nessus 的判定取決於廠商所報告的套件是否存在。

Linux/Unix 主机中安装的一个或多个程序包受到一个漏洞影响，而供应商没有提供补丁程序。

  - 在 Moodle 3.0 至 3.0.3、 2.9 至 2.9.5、 2.8 至 2.8.11、 2.7 至 2.7.13及更早版本中访问其他徽标的功能检查允许经认证的远程用户读取其他用户的徽标。 (CVE-2016-3732)

请注意，Nessus 依赖供应商报告的程序包是否存在进行判断。

Marina Glancy 報告：

- MSA-16-0013：使用者能夠變更系統管理員鎖定的設定檔欄位。

- MSA-16-0015：隱藏論壇名稱與子名稱的資訊洩漏。

- MSA-16-0016：使用者可在無正確權限的情況下檢視其他使用者的徽章。

- MSA-16-0017：課程 id 編號未受到保護，可由老師還原。

- MSA-16-0018：指令碼中的 CSRF 將論壇貼文標記為已讀。

Marina Glancy 报告：

- MSA-16-0013：用户能够变更系统管理员锁定的配置文件字段。

- MSA-16-0015：隐藏论坛名称与子名称的信息泄露。

- MSA-16-0016：用户可在无正确权限的情况下查看其他用户的徽标。

- MSA-16-0017：课程 id 编号未受到保护，可由老师还原。

- MSA-16-0018：脚本中的 CSRF 将论坛帖子标记为已读。

Marina Glancy 氏の報告：

- MSA-16-0013：ユーザーが、管理者によってロックされたプロファイルフィールドを変更できます。

- MSA-16-0015：非表示のフォーラム名およびサブ名の情報漏洩。

- MSA-16-0016：ユーザーが、適切なパーミッションなしで他のユーザーのバッジを表示できます。

- MSA-16-0017：コース idnumber が教師の復元から保護されていません。

- MSA-16-0018：フォーラムの投稿を既読にマークするスクリプトの CSRF。

Linux/Unix ホストには、ベンダーが提供するパッチが利用できない脆弱性の影響を受ける複数のパッケージがインストールされています。

  - Moodle 3.0 から 3.0.3、 2.9 から 2.9.5、 2.8 から 2.8.11、 2.7 から 2.7.13、およびそれ以前の他のバッジにアクセスするための機能チェックにより、認証されたリモートユーザーが他のユーザーのバッジを読み取る可能性があります。CVE-2016-3732

Nessus は、ベンダーによって報告されたパッケージの存在に依存していることに注意してください。

The Linux/Unix host has one or more packages installed that are impacted by a vulnerability without a vendor supplied patch available.

  - The capability check to access other badges in Moodle 3.0 through 3.0.3, 2.9 through 2.9.5, 2.8 through     2.8.11, 2.7 through 2.7.13, and earlier allows remote authenticated users to read the badges of other     users. (CVE-2016-3732)

Note that Nessus relies on the presence of the package as reported by the vendor.

Marina Glancy reports :

- MSA-16-0013: Users are able to change profile fields that were locked by the administrator.

- MSA-16-0015: Information disclosure of hidden forum names and sub-names.

- MSA-16-0016: User can view badges of other users without proper permissions.

- MSA-16-0017: Course idnumber not protected from teacher restore.

- MSA-16-0018: CSRF in script marking forum posts as read.

ID	Name	Product	Family	Published	Updated	Severity
9428	Moodle 2.7.x < 2.7.14 Multiple Vulnerabilities	Nessus Network Monitor	CGI	7/21/2016	3/6/2019	critical
9427	Moodle 2.8.x < 2.8.12 / 2.9.x < 2.9.6 / 3.0.x < 3.0.4 Multiple Vulnerabilities	Nessus Network Monitor	CGI	7/21/2016	3/6/2019	critical
432144	SCA: security update for moodle/moodle (GHSA-5282-96ff-xx3h)	Tenable Cloud Security	SCA Checks	8/7/2025	7/2/2026	medium
432144	SCA: security update for moodle/moodle (GHSA-5282-96ff-xx3h)	Tenable Self-Hosted Container Security	SCA Checks	8/7/2025	7/2/2026	medium
261413	Linux Distros 未修補的弱點：CVE-2016-3732	Nessus	Misc.	9/5/2025	7/12/2026	medium
261413	Linux Distros 未修补的漏洞：CVE-2016-3732	Nessus	Misc.	9/5/2025	7/12/2026	medium
91930	FreeBSD：moodle -- 多個弱點 (8656cf5f-4170-11e6-8dfe-002590263bf5)	Nessus	FreeBSD Local Security Checks	7/5/2016	1/4/2021	high
91930	FreeBSD：moodle -- 多种漏洞 (8656cf5f-4170-11e6-8dfe-002590263bf5)	Nessus	FreeBSD Local Security Checks	7/5/2016	1/4/2021	high
91930	FreeBSD：moodle -- 複数の脆弱性（8656cf5f-4170-11e6-8dfe-002590263bf5）	Nessus	FreeBSD Local Security Checks	7/5/2016	1/4/2021	high
261413	Linux Distros のパッチ未適用の脆弱性: CVE-2016-3732	Nessus	Misc.	9/5/2025	7/12/2026	medium
261413	Linux Distros Unpatched Vulnerability : CVE-2016-3732	Nessus	Misc.	9/5/2025	7/12/2026	medium
91930	FreeBSD : moodle -- multiple vulnerabilities (8656cf5f-4170-11e6-8dfe-002590263bf5)	Nessus	FreeBSD Local Security Checks	7/5/2016	1/4/2021	high

Detections

Analytics

Plugins Search

critical

critical

medium

medium

medium

medium

high

high

high

medium

medium

high