CVE-2016-0724
Moodle sensitive information disclosure
The (1) core_enrol_get_course_enrolment_methods and (2) enrol_self_get_instance_info web services in Moodle through 2.6.11, 2.7.x before 2.7.12, 2.8.x before 2.8.10, 2.9.x before 2.9.4, and 3.0.x before 3.0.2 do not consider the moodle/course:viewhiddencourses capability, which allows remote authenticated users to obtain sensitive information via a web-service request.
Attack profile
How easy it is to exploit
- Attack vector
- Network
- Complexity
- Low
- Privileges needed
- Low
- User interaction
- None
What an attacker can affect
- Confidentiality
- Low
- Integrity
- None
- Availability
- None
Exploit likelihood
What each source reports
NVD Score used
The (1) core_enrol_get_course_enrolment_methods and (2) enrol_self_get_instance_info web services in Moodle through 2.6.11, 2.7.x before 2.7.12, 2.8.x before 2.8.10, 2.9.x before 2.9.4, and 3.0.x before 3.0.2 do not consider the moodle/course:viewhiddencourses capability, which allows remote authenticated users to obtain sensitive information via a web-service request.
- Record
CVE-2016-0724- CVSS 3.0
- 4.3 Medium
CVSS:3.0/AV:N/AC:L/PR:L/UI:N/S:U/C:L/I:N/A:N - CVSS 2.0
- 4.0 Medium
AV:N/AC:L/Au:S/C:P/I:N/A:N - Weakness
- CWE-200, CWE-264
- Updated
- 2026-11-02
CVE List No score
The (1) core_enrol_get_course_enrolment_methods and (2) enrol_self_get_instance_info web services in Moodle through 2.6.11, 2.7.x before 2.7.12, 2.8.x before 2.8.10, 2.9.x before 2.9.4, and 3.0.x before 3.0.2 do not consider the moodle/course:viewhiddencourses capability, which allows remote authenticated users to obtain sensitive information via a web-service request.
- Record
CVE-2016-0724- Updated
- 2026-11-02
EUVDEUVD-2022-4171 No score
The (1) core_enrol_get_course_enrolment_methods and (2) enrol_self_get_instance_info web services in Moodle through 2.6.11, 2.7.x before 2.7.12, 2.8.x before 2.8.10, 2.9.x before 2.9.4, and 3.0.x before 3.0.2 do not consider the moodle/course:viewhiddencourses capability, which allows remote authenticated users to obtain sensitive information via a web-service request.
- Record
EUVD-2022-4171- Updated
- 2026-11-03
GitHub AdvisoriesGHSA-hjrj-7wcj-7j3c
Moodle sensitive information disclosure
The (1) core_enrol_get_course_enrolment_methods and (2) enrol_self_get_instance_info web services in Moodle through 2.6.11, 2.7.x before 2.7.12, 2.8.x before 2.8.10, 2.9.x before 2.9.4, and 3.0.x before 3.0.2 do not consider the moodle/course:viewhiddencourses capability, which allows remote authenticated users to obtain sensitive information via a web-service request.
- Record
GHSA-hjrj-7wcj-7j3c- CVSS 3.0
- 4.3 Medium
CVSS:3.0/AV:N/AC:L/PR:L/UI:N/S:U/C:L/I:N/A:N - Weakness
- CWE-200
- Updated
- 2026-11-02
OSV
The (1) core_enrol_get_course_enrolment_methods and (2) enrol_self_get_instance_info web services in Moodle through 2.6.11, 2.7.x before 2.7.12, 2.8.x before 2.8.10, 2.9.x before 2.9.4, and 3.0.x before 3.0.2 do not consider the moodle/course:viewhiddencourses capability, which allows remote authenticated users to obtain sensitive information via a web-service request.
- Record
CVE-2016-0724- CVSS 3.0
- 4.3 Medium
CVSS:3.0/AV:N/AC:L/PR:L/UI:N/S:U/C:L/I:N/A:N - Updated
- 2026-11-02
OSVGHSA-hjrj-7wcj-7j3c
Moodle sensitive information disclosure
The (1) core_enrol_get_course_enrolment_methods and (2) enrol_self_get_instance_info web services in Moodle through 2.6.11, 2.7.x before 2.7.12, 2.8.x before 2.8.10, 2.9.x before 2.9.4, and 3.0.x before 3.0.2 do not consider the moodle/course:viewhiddencourses capability, which allows remote authenticated users to obtain sensitive information via a web-service request.
- Record
GHSA-hjrj-7wcj-7j3c- CVSS 3.0
- 4.3 Medium
CVSS:3.0/AV:N/AC:L/PR:L/UI:N/S:U/C:L/I:N/A:N - Weakness
- CWE-200
- Updated
- 2026-11-02
OSVUBUNTU-CVE-2016-0724
The (1) core_enrol_get_course_enrolment_methods and (2) enrol_self_get_instance_info web services in Moodle through 2.6.11, 2.7.x before 2.7.12, 2.8.x before 2.8.10, 2.9.x before 2.9.4, and 3.0.x before 3.0.2 do not consider the moodle/course:viewhiddencourses capability, which allows remote authenticated users to obtain sensitive information via a web-service request.
- Record
UBUNTU-CVE-2016-0724- CVSS 3.0
- 4.3 Medium
CVSS:3.0/AV:N/AC:L/PR:L/UI:N/S:U/C:L/I:N/A:N - Updated
- 2026-11-02
OSVMGASA-2016-0029 No score
Updated moodle packages fix security vulnerability
In Moodle before 2.8.10, web services core_enrol_get_course_enrolment_methods and enrol_self_get_instance_info did not check user permission to access hidden courses (CVE-2016-0724).
In Moodle before 2.8.10, search string in course management interface was not escaped when being output creating potential for XSS attack (CVE-2016-0725).
- Record
MGASA-2016-0029- Updated
- 2026-11-02
Affected products
Affected packages
| Package | Affected | Fixed |
|---|---|---|
moodle/moodlePackagist |
through 2.6.11 | None known |
moodle/moodlePackagist |
2.7.0 up to 2.7.12 | 2.7.12 |
moodle/moodlePackagist |
2.8.0 up to 2.8.10 | 2.8.10 |
moodle/moodlePackagist |
2.9.0 up to 2.9.4 | 2.9.4 |
moodle/moodlePackagist |
3.0.0 up to 3.0.2 | 3.0.2 |
moodle/moodlePackagist |
through 2.6.11, plus listed versions v2.3.10v2.3.11v2.3.4v2.3.5v2.3.6 Show 42 moreShow lessv2.3.7v2.3.8v2.3.9v2.4.0v2.4.0-rc1v2.4.1v2.4.10v2.4.11v2.4.2v2.4.3v2.4.4v2.4.5v2.4.6v2.4.7v2.4.8v2.4.9v2.5.0v2.5.0-betav2.5.0-rc1v2.5.1v2.5.2v2.5.3v2.5.4v2.5.5v2.5.6v2.5.7v2.5.8v2.5.9v2.6.0v2.6.0-betav2.6.0-rc1v2.6.1v2.6.10v2.6.11v2.6.2v2.6.3v2.6.4v2.6.5v2.6.6v2.6.7v2.6.8v2.6.9 |
None known |
moodle/moodlePackagist |
2.7.0 up to 2.7.12, plus listed versions v2.7.0v2.7.1v2.7.10v2.7.11v2.7.2 Show 7 moreShow lessv2.7.3v2.7.4v2.7.5v2.7.6v2.7.7v2.7.8v2.7.9 |
2.7.12 |
moodle/moodlePackagist |
2.8.0 up to 2.8.10, plus listed versions v2.8.0v2.8.1v2.8.2v2.8.3v2.8.4 Show 5 moreShow lessv2.8.5v2.8.6v2.8.7v2.8.8v2.8.9 |
2.8.10 |
moodle/moodlePackagist |
2.9.0 up to 2.9.4, plus listed versions v2.9.0v2.9.1v2.9.2v2.9.3 |
2.9.4 |
moodle/moodlePackagist |
3.0.0 up to 3.0.2, plus listed versions v3.0.0v3.0.1 |
3.0.2 |
moodleMageia:5 From an advisory covering 2 CVEs |
before 2.8.10-1.mga5 | 2.8.10-1.mga5 |
History
| Recorded | Changed | Sources |
|---|---|---|
| affected, facts | ||
| affected | ||
| aliases | EUVD | |
| first indexed | CVE List, GitHub Advisories, NVD, OSV |
Dates are when Every CVE recorded each change. Upstream dates may differ.
In short
CVE-2016-0724 is a medium vulnerability (CVSS 4.3) in Moodle, published January 20, 2016. No source lists public exploit code. EPSS puts the chance of exploitation in the next 30 days at 1.94%, the 80th percentile. Fixed in moodle/moodle 2.7.12.
References
securitytracker.com/id/1034694
moodle.org/mod/forum/discuss.php?d=326205
git.moodle.org/gw?p=moodle.git&a=search&h=HEAD&st=commit&s=MDL-52072
openwall.com/lists/oss-security/2016/01/18/1
lists.fedoraproject.org/pipermail/package-announce/2016-February/176502.html
Show 12 moreShow less
nvd.nist.gov/vuln/detail/CVE-2016-0724
web.archive.org/web/20210622172957/http://www.securitytracker.com/id/1034694
github.com/moodle/moodle/commit/4323a973d57a41e19e039a850ad71ebcabae73c1
advisories.mageia.org/MGASA-2016-0029.html
bugs.mageia.org/show_bug.cgi?id=17537
docs.moodle.org/dev/Moodle_2.8.10_release_notes
ubuntu.com/security/CVE-2016-0724
cve.org/CVERecord?id=CVE-2016-0724