8.8high
CVE-2016-2157
Moodle cross-site request forgery (CSRF) vulnerability
Also known as GHSA-f5pm-c4cw-563p
Published 10 y ago · modified 4 mo ago · JSON
CVSS
8.8
v3.0 · NVD
CISA KEV
No
not known exploited
EPSS
1.0%
percentile 62%
Public exploits
0
none known
Summary
Cross-site request forgery (CSRF) vulnerability in mod/assign/adminmanageplugins.php in Moodle through 2.6.11, 2.7.x before 2.7.13, 2.8.x before 2.8.11, 2.9.x before 2.9.5, and 3.0.x before 3.0.3 allows remote attackers to hijack the authentication of administrators for requests that manage Assignment plugins.
Exploit prediction (EPSS)
0.97% probability of exploitation in the next 30 days, higher than 62% of all scored CVEs.
CVSS scores
| Assigned by | Version | Score | Vector |
|---|---|---|---|
| NVD | 3.0 | 8.8 | CVSS:3.0/AV:N/AC:L/PR:N/UI:R/S:U/C:H/I:H/A:H |
| NVD | 2.0 | 6.8 | AV:N/AC:M/Au:N/C:P/I:P/A:P |
| GitHub | 3.0 | 8.8 | CVSS:3.0/AV:N/AC:L/PR:N/UI:R/S:U/C:H/I:H/A:H |
Affected packages
| Ecosystem | Package | Affected | Fixed in |
|---|---|---|---|
| packagist | moodle/moodle | <2.7.13 >=2.8.0, <2.8.11 >=2.9.0, <2.9.5 >=3.0.0, <3.0.3 | 2.7.13 2.8.11 2.9.5 3.0.3 |
Classification
- Weakness
- CWE-352 Cross-Site Request Forgery
References
- openwall.com /lists/oss-security/2016/03/21/1 · mailing-list, x_refsource_MLIST, x_transferred
- git.moodle.org /gw?p=moodle.git&a=search&h=HEAD&st=commit&s=MDL-53031 · x_refsource_CONFIRM, x_transferred
- moodle.org /mod/forum/discuss.php?d=330179 · x_refsource_CONFIRM, x_transferred
- securitytracker.com /id/1035333 · vdb-entry, x_refsource_SECTRACK, x_transferred
- nvd.nist.gov /vuln/detail/CVE-2016-2157 · advisory
- github.com /moodle/moodle/commit/01b19e761f94a4f3615d5c8f6314309aa83469f3 · web
- github.com /moodle/moodle/commit/1452f1e1d37d816648e3e015296de59509847287 · web
- github.com /moodle/moodle/commit/55ba3a26d2710ce3c5f13287b0c3538b9a934fa4 · web
- github.com /moodle/moodle/commit/85984545a937b0790c355473d7295eb60b0265eb · web
- github.com /moodle/moodle/commit/a0cd21cd5cc63961243518a58e9d5d01182dbbb4 · web
- github.com /moodle/moodle · package
- web.archive.org /web/20160424224349/http://www.securitytracker.com/id/1035333 · web
Sources
- CVE List: CVE-2016-2157
- GitHub Advisory: GHSA-f5pm-c4cw-563p
- NVD: CVE-2016-2157
vulnwire keeps one entry per vulnerability: the CVE id wins, then GHSA; records that alias each other are merged. Machine-readable: JSON.