CVE-2016-3734
Moodle Cross-site request forgery (CSRF) vulnerability
Cross-site request forgery (CSRF) vulnerability in markposts.php in Moodle 3.0 through 3.0.3, 2.9 through 2.9.5, 2.8 through 2.8.11, 2.7 through 2.7.13 and earlier allows remote attackers to hijack the authentication of users for requests that marks forum posts as read.
Attack profile
How easy it is to exploit
- Attack vector
- Network
- Complexity
- Low
- Privileges needed
- None
- User interaction
- Required
What an attacker can affect
- Confidentiality
- High
- Integrity
- High
- Availability
- High
Exploit likelihood
What each source reports
NVD Score used
Cross-site request forgery (CSRF) vulnerability in markposts.php in Moodle 3.0 through 3.0.3, 2.9 through 2.9.5, 2.8 through 2.8.11, 2.7 through 2.7.13 and earlier allows remote attackers to hijack the authentication of users for requests that marks forum posts as read.
- Record
CVE-2016-3734- CVSS 3.0
- 8.8 High
CVSS:3.0/AV:N/AC:L/PR:N/UI:R/S:U/C:H/I:H/A:H - CVSS 2.0
- 6.8 Medium
AV:N/AC:M/Au:N/C:P/I:P/A:P - Weakness
- CWE-352
- Updated
- 2026-11-02
CVE List No score
Cross-site request forgery (CSRF) vulnerability in markposts.php in Moodle 3.0 through 3.0.3, 2.9 through 2.9.5, 2.8 through 2.8.11, 2.7 through 2.7.13 and earlier allows remote attackers to hijack the authentication of users for requests that marks forum posts as read.
- Record
CVE-2016-3734- Updated
- 2026-11-02
EUVDEUVD-2022-5130 No score
Cross-site request forgery (CSRF) vulnerability in markposts.php in Moodle 3.0 through 3.0.3, 2.9 through 2.9.5, 2.8 through 2.8.11, 2.7 through 2.7.13 and earlier allows remote attackers to hijack the authentication of users for requests that marks forum posts as read.
- Record
EUVD-2022-5130- Updated
- 2026-11-03
GitHub AdvisoriesGHSA-r867-v437-4rrm
Moodle Cross-site request forgery (CSRF) vulnerability
Cross-site request forgery (CSRF) vulnerability in markposts.php in Moodle 3.0 through 3.0.3, 2.9 through 2.9.5, 2.8 through 2.8.11, 2.7 through 2.7.13 and earlier allows remote attackers to hijack the authentication of users for requests that marks forum posts as read.
- Record
GHSA-r867-v437-4rrm- CVSS 3.0
- 8.8 High
CVSS:3.0/AV:N/AC:L/PR:N/UI:R/S:U/C:H/I:H/A:H - Weakness
- CWE-352
- Updated
- 2026-11-02
OSV
Cross-site request forgery (CSRF) vulnerability in markposts.php in Moodle 3.0 through 3.0.3, 2.9 through 2.9.5, 2.8 through 2.8.11, 2.7 through 2.7.13 and earlier allows remote attackers to hijack the authentication of users for requests that marks forum posts as read.
- Record
CVE-2016-3734- CVSS 3.0
- 8.8 High
CVSS:3.0/AV:N/AC:L/PR:N/UI:R/S:U/C:H/I:H/A:H - Updated
- 2026-11-02
OSVGHSA-r867-v437-4rrm
Moodle Cross-site request forgery (CSRF) vulnerability
Cross-site request forgery (CSRF) vulnerability in markposts.php in Moodle 3.0 through 3.0.3, 2.9 through 2.9.5, 2.8 through 2.8.11, 2.7 through 2.7.13 and earlier allows remote attackers to hijack the authentication of users for requests that marks forum posts as read.
- Record
GHSA-r867-v437-4rrm- CVSS 3.0
- 8.8 High
CVSS:3.0/AV:N/AC:L/PR:N/UI:R/S:U/C:H/I:H/A:H - Weakness
- CWE-352
- Updated
- 2026-11-02
OSVUBUNTU-CVE-2016-3734
Cross-site request forgery (CSRF) vulnerability in markposts.php in Moodle 3.0 through 3.0.3, 2.9 through 2.9.5, 2.8 through 2.8.11, 2.7 through 2.7.13 and earlier allows remote attackers to hijack the authentication of users for requests that marks forum posts as read.
- Record
UBUNTU-CVE-2016-3734- CVSS 3.0
- 8.8 High
CVSS:3.0/AV:N/AC:L/PR:N/UI:R/S:U/C:H/I:H/A:H - Updated
- 2026-11-02
Affected products
Affected packages
| Package | Affected | Fixed |
|---|---|---|
moodle/moodlePackagist |
before 2.7.14 | 2.7.14 |
moodle/moodlePackagist |
2.8 up to 2.8.12 | 2.8.12 |
moodle/moodlePackagist |
2.9 up to 2.9.6 | 2.9.6 |
moodle/moodlePackagist |
3.0 up to 3.0.4 | 3.0.4 |
moodle/moodlePackagist |
before 2.7.14, plus listed versions v2.3.10v2.3.11v2.3.4v2.3.5v2.3.6 Show 45 moreShow lessv2.3.7v2.3.8v2.3.9v2.4.0v2.4.0-rc1v2.4.1v2.4.10v2.4.11v2.4.2v2.4.3v2.4.4v2.4.5v2.4.6v2.4.7v2.4.8v2.4.9v2.5.0v2.5.0-betav2.5.0-rc1v2.5.1v2.5.2v2.5.3v2.5.4v2.5.5v2.5.6v2.5.7v2.5.8v2.5.9v2.6.0v2.6.0-betav2.6.0-rc1v2.6.1v2.6.10v2.6.11v2.6.2v2.6.3v2.6.4v2.6.5v2.6.6v2.6.7v2.6.8v2.6.9v2.7.0v2.7.0-betav2.7.0-rc1 |
2.7.14 |
moodle/moodlePackagist |
2.8 up to 2.8.12, plus listed versions v2.8.0v2.8.0-betav2.8.0-rc1v2.8.0-rc2v2.8.1 Show 10 moreShow lessv2.8.10v2.8.11v2.8.2v2.8.3v2.8.4v2.8.5v2.8.6v2.8.7v2.8.8v2.8.9 |
2.8.12 |
moodle/moodlePackagist |
2.9 up to 2.9.6, plus listed versions v2.9.0v2.9.0-betav2.9.0-rc1v2.9.0-rc2v2.9.1 Show 4 moreShow lessv2.9.2v2.9.3v2.9.4v2.9.5 |
2.9.6 |
moodle/moodlePackagist |
3.0 up to 3.0.4, plus listed versions v3.0.0v3.0.0-betav3.0.0-rc1v3.0.0-rc2v3.0.0-rc3 Show 4 moreShow lessv3.0.0-rc4v3.0.1v3.0.2v3.0.3 |
3.0.4 |
History
| Recorded | Changed | Sources |
|---|---|---|
| affected | ||
| aliases | EUVD | |
| first indexed | CVE List, GitHub Advisories, NVD, OSV |
Dates are when Every CVE recorded each change. Upstream dates may differ.
In short
CVE-2016-3734 is a high vulnerability (CVSS 8.8) in Moodle, published April 20, 2017. No source lists public exploit code. EPSS puts the chance of exploitation in the next 30 days at 1.13%, the 66th percentile. Fixed in moodle/moodle 2.7.14.
References
openwall.com/lists/oss-security/2016/05/17/4
git.moodle.org/gw?p=moodle.git&a=search&h=HEAD&st=commit&s=MDL-53755
bugzilla.redhat.com/show_bug.cgi?id=1335933
securitytracker.com/id/1035902
securityfocus.com/bid/91281
nvd.nist.gov/vuln/detail/CVE-2016-3734
Show 11 moreShow less
github.com/moodle/moodle/commit/01408d619ba89d32f9ad83308990ff9b0374cb57
web.archive.org/web/20160703032310/http://www.securitytracker.com/id/1035902
ubuntu.com/security/CVE-2016-3734
cve.org/CVERecord?id=CVE-2016-3734
Left out here: 14 versions. The JSON record has them.