Description

lib/ajax/getnavbranch.php in Moodle through 2.6.11, 2.7.x before 2.7.13, 2.8.x before 2.8.11, 2.9.x before 2.9.5, and 3.0.x before 3.0.3, when the forcelogin feature is enabled, allows remote attackers to obtain sensitive category-detail information from the navigation branch by leveraging the guest role for an Ajax request.

Remediation

References

CVE-2016-2158

Related Vulnerabilities

WordPress Plugin Post Form-Registration Form-Profile Form for User Profiles and Content Forms for User Submissions Security Bypass (2.3.2)

Apache Traffic Server Improper Input Validation Vulnerability (CVE-2017-5660)

Mailman Improper Neutralization of Input During Web Page Generation ('Cross-site Scripting') Vulnerability (CVE-2020-12137)

Joomla Deserialization of Untrusted Data Vulnerability (CVE-2019-7743)

WordPress 3.7.x Multiple Vulnerabilities (3.7 - 3.7.25)

Severity

Medium

Classification

CVE-2016-2158 CWE-200 CVSS:3.0/AV:N/AC:L/PR:L/UI:N/S:U/C:L/I:N/A:N

Tags

Missing Update Known Vulnerabilities