CVE-2016-3733

Moodle Improper Access Control

4.3 MediumFix available

CVE-2016-3733 is a medium vulnerability (CVSS 4.3) in Moodle, published April 20, 2017. No source lists public exploit code. EPSS puts the chance of exploitation in the next 30 days at 1.17%, the 67th percentile. Fixed in moodle/moodle 2.7.14.

The "restore teacher" feature in Moodle 3.0 through 3.0.3, 2.9 through 2.9.5, 2.8 through 2.8.11, 2.7 through 2.7.13, and earlier allows remote authenticated users to overwrite the course idnumber.

Attack profile

How easy it is to exploit

Attack vector: Network
Complexity: Low
Privileges needed: Low
User interaction: None

What an attacker can affect

Confidentiality: None
Integrity: Low
Availability: None

Exploit likelihood

1.17%Unchanged since Feb 4, 2022

What each source reports

NVD Score used 4.3

The "restore teacher" feature in Moodle 3.0 through 3.0.3, 2.9 through 2.9.5, 2.8 through 2.8.11, 2.7 through 2.7.13, and earlier allows remote authenticated users to overwrite the course idnumber.

Record: CVE-2016-3733
CVSS 3.0: 4.3 MediumCVSS:3.0/AV:N/AC:L/PR:L/UI:N/S:U/C:N/I:L/A:N
CVSS 2.0: 4.0 MediumAV:N/AC:L/Au:S/C:N/I:P/A:N
Weakness: CWE-284
Updated: 2026-11-02

CVE List No score

The "restore teacher" feature in Moodle 3.0 through 3.0.3, 2.9 through 2.9.5, 2.8 through 2.8.11, 2.7 through 2.7.13, and earlier allows remote authenticated users to overwrite the course idnumber.

Record: CVE-2016-3733
Updated: 2026-11-02

EUVDEUVD-2022-3998 No score

The "restore teacher" feature in Moodle 3.0 through 3.0.3, 2.9 through 2.9.5, 2.8 through 2.8.11, 2.7 through 2.7.13, and earlier allows remote authenticated users to overwrite the course idnumber.

Record: EUVD-2022-3998
Updated: 2026-11-03

GitHub AdvisoriesGHSA-gr8j-qm8r-rfgg 4.3

Moodle Improper Access Control

The "restore teacher" feature in Moodle 3.0 through 3.0.3, 2.9 through 2.9.5, 2.8 through 2.8.11, 2.7 through 2.7.13, and earlier allows remote authenticated users to overwrite the course idnumber.

Record: GHSA-gr8j-qm8r-rfgg
CVSS 3.0: 4.3 MediumCVSS:3.0/AV:N/AC:L/PR:L/UI:N/S:U/C:N/I:L/A:N
Weakness: CWE-284
Updated: 2026-11-02

OSV 4.3

The "restore teacher" feature in Moodle 3.0 through 3.0.3, 2.9 through 2.9.5, 2.8 through 2.8.11, 2.7 through 2.7.13, and earlier allows remote authenticated users to overwrite the course idnumber.

Record: CVE-2016-3733
CVSS 3.0: 4.3 MediumCVSS:3.0/AV:N/AC:L/PR:L/UI:N/S:U/C:N/I:L/A:N
Updated: 2026-11-02

OSVGHSA-gr8j-qm8r-rfgg 4.3

Moodle Improper Access Control

The "restore teacher" feature in Moodle 3.0 through 3.0.3, 2.9 through 2.9.5, 2.8 through 2.8.11, 2.7 through 2.7.13, and earlier allows remote authenticated users to overwrite the course idnumber.

Record: GHSA-gr8j-qm8r-rfgg
CVSS 3.0: 4.3 MediumCVSS:3.0/AV:N/AC:L/PR:L/UI:N/S:U/C:N/I:L/A:N
Weakness: CWE-284
Updated: 2026-11-02

OSVUBUNTU-CVE-2016-3733 4.3

The "restore teacher" feature in Moodle 3.0 through 3.0.3, 2.9 through 2.9.5, 2.8 through 2.8.11, 2.7 through 2.7.13, and earlier allows remote authenticated users to overwrite the course idnumber.

Record: UBUNTU-CVE-2016-3733
CVSS 3.0: 4.3 MediumCVSS:3.0/AV:N/AC:L/PR:L/UI:N/S:U/C:N/I:L/A:N
Updated: 2026-11-02

Affected products

moodle

Affected packages

Affected packages
Package	Affected	Fixed
`moodle/moodle` Packagist	2.7 up to 2.7.14	2.7.14
`moodle/moodle` Packagist	2.8 up to 2.8.12	2.8.12
`moodle/moodle` Packagist	2.9 up to 2.9.6	2.9.6
`moodle/moodle` Packagist	3.0 up to 3.0.4	3.0.4
`moodle/moodle` Packagist	2.7 up to 2.7.14, plus listed versions v2.7.0v2.7.0-betav2.7.0-rc1v2.7.0-rc2v2.7.1 Show 12 moreShow less v2.7.10v2.7.11v2.7.12v2.7.13v2.7.2v2.7.3v2.7.4v2.7.5v2.7.6v2.7.7v2.7.8v2.7.9	2.7.14
`moodle/moodle` Packagist	2.8 up to 2.8.12, plus listed versions v2.8.0v2.8.0-betav2.8.0-rc1v2.8.0-rc2v2.8.1 Show 10 moreShow less v2.8.10v2.8.11v2.8.2v2.8.3v2.8.4v2.8.5v2.8.6v2.8.7v2.8.8v2.8.9	2.8.12
`moodle/moodle` Packagist	2.9 up to 2.9.6, plus listed versions v2.9.0v2.9.0-betav2.9.0-rc1v2.9.0-rc2v2.9.1 Show 4 moreShow less v2.9.2v2.9.3v2.9.4v2.9.5	2.9.6
`moodle/moodle` Packagist	3.0 up to 3.0.4, plus listed versions v3.0.0v3.0.0-betav3.0.0-rc1v3.0.0-rc2v3.0.0-rc3 Show 4 moreShow less v3.0.0-rc4v3.0.1v3.0.2v3.0.3	3.0.4

History

History
When	Changed	Sources
2026-11-03	affected
2026-11-03	aliases	EUVD
2026-11-02	created	CVE List, GitHub Advisories, NVD, OSV

References

Show 6 moreShow less