{"id":"CVE-2016-3729","aliases":["EUVD-2022-3929","GHSA-g96h-wvrm-c2ww","UBUNTU-CVE-2016-3729"],"status":"published","title":"Moodle Improper Access Control","description":"The user editing form in Moodle 3.0 through 3.0.3, 2.9 through 2.9.5, 2.8 through 2.8.11, 2.7 through 2.7.13, and earlier allows remote authenticated users to edit profile fields locked by the administrator.","severity":{"version":"3.0","score":6.5,"vector":"CVSS:3.0/AV:N/AC:L/PR:L/UI:N/S:U/C:N/I:H/A:N","level":"medium","assessor":"primary","from":"nvd"},"epss":{"day":"2026-11-08","score":0.01282,"percentile":0.70249,"model":"v2026.06.15"},"facts":{"in_kev":false,"known_exploited":false,"public_exploit":false,"fix_available":true},"cwes":["CWE-284"],"published":"2017-04-20T21:00:00Z","modified":"2026-10-24T10:30:22Z","fixes":[{"ecosystem":"Packagist","package":"moodle/moodle","fixed_in":["3.0.3","2.9.6","2.8.12","2.7.14"],"sources":["ghsa","osv"]}],"affected":[{"source":"ghsa","ecosystem":"Packagist","package":"moodle/moodle","ranges":[{"type":"ECOSYSTEM","events":[{"introduced":"3.0"},{"fixed":"3.0.3"}]}]},{"source":"ghsa","ecosystem":"Packagist","package":"moodle/moodle","ranges":[{"type":"ECOSYSTEM","events":[{"introduced":"2.9"},{"fixed":"2.9.6"}]}]},{"source":"ghsa","ecosystem":"Packagist","package":"moodle/moodle","ranges":[{"type":"ECOSYSTEM","events":[{"introduced":"2.8"},{"fixed":"2.8.12"}]}]},{"source":"ghsa","ecosystem":"Packagist","package":"moodle/moodle","ranges":[{"type":"ECOSYSTEM","events":[{"introduced":"2.7"},{"fixed":"2.7.14"}]}]},{"source":"osv","ecosystem":"Packagist","package":"moodle/moodle","ranges":[{"type":"ECOSYSTEM","events":[{"introduced":"3.0"},{"fixed":"3.0.3"}]}],"versions":["v3.0.0","v3.0.0-beta","v3.0.0-rc1","v3.0.0-rc2","v3.0.0-rc3","v3.0.0-rc4","v3.0.1","v3.0.2"]},{"source":"osv","ecosystem":"Packagist","package":"moodle/moodle","ranges":[{"type":"ECOSYSTEM","events":[{"introduced":"2.9"},{"fixed":"2.9.6"}]}],"versions":["v2.9.0","v2.9.0-beta","v2.9.0-rc1","v2.9.0-rc2","v2.9.1","v2.9.2","v2.9.3","v2.9.4","v2.9.5"]},{"source":"osv","ecosystem":"Packagist","package":"moodle/moodle","ranges":[{"type":"ECOSYSTEM","events":[{"introduced":"2.8"},{"fixed":"2.8.12"}]}],"versions":["v2.8.0","v2.8.0-beta","v2.8.0-rc1","v2.8.0-rc2","v2.8.1","v2.8.10","v2.8.11","v2.8.2","v2.8.3","v2.8.4","v2.8.5","v2.8.6","v2.8.7","v2.8.8","v2.8.9"]},{"source":"osv","ecosystem":"Packagist","package":"moodle/moodle","ranges":[{"type":"ECOSYSTEM","events":[{"introduced":"2.7"},{"fixed":"2.7.14"}]}],"versions":["v2.7.0","v2.7.0-beta","v2.7.0-rc1","v2.7.0-rc2","v2.7.1","v2.7.10","v2.7.11","v2.7.12","v2.7.13","v2.7.2","v2.7.3","v2.7.4","v2.7.5","v2.7.6","v2.7.7","v2.7.8","v2.7.9"]}],"products":[{"vendor":"moodle","product":"moodle"}],"references":[{"url":"http://www.openwall.com/lists/oss-security/2016/05/17/4","tags":["mailing-list","x_refsource_MLIST","x_transferred","Mailing List","Third Party Advisory","advisory","web"]},{"url":"https://bugzilla.redhat.com/show_bug.cgi?id=1335933","tags":["x_refsource_CONFIRM","x_transferred","Issue Tracking","Third Party Advisory","report","web"]},{"url":"http://www.securitytracker.com/id/1035902","tags":["vdb-entry","x_refsource_SECTRACK","x_transferred","Third Party Advisory","VDB Entry","advisory","web"]},{"url":"https://nvd.nist.gov/vuln/detail/CVE-2016-3729","tags":["advisory"]},{"url":"https://github.com/advisories/GHSA-g96h-wvrm-c2ww"},{"url":"https://github.com/moodle/moodle","tags":["package"]},{"url":"https://ubuntu.com/security/CVE-2016-3729","tags":["report"]},{"url":"https://www.cve.org/CVERecord?id=CVE-2016-3729","tags":["report"]}],"sources":{"cve":[{"id":"CVE-2016-3729","description":"The user editing form in Moodle 3.0 through 3.0.3, 2.9 through 2.9.5, 2.8 through 2.8.11, 2.7 through 2.7.13, and earlier allows remote authenticated users to edit profile fields locked by the administrator.","status":"published","published":"2017-04-20T21:00:00Z","modified":"2024-08-06T00:03:34.416Z","updated_at":"2026-11-02T14:33:34.094161Z"}],"euvd":[{"id":"EUVD-2022-3929","description":"The user editing form in Moodle 3.0 through 3.0.3, 2.9 through 2.9.5, 2.8 through 2.8.11, 2.7 through 2.7.13, and earlier allows remote authenticated users to edit profile fields locked by the administrator.","status":"published","published":"2017-04-20T21:00:00Z","modified":"2024-08-06T00:03:34Z","updated_at":"2026-11-03T02:22:49.109782Z"}],"ghsa":[{"id":"GHSA-g96h-wvrm-c2ww","title":"Moodle Improper Access Control","description":"The user editing form in Moodle 3.0 through 3.0.3, 2.9 through 2.9.5, 2.8 through 2.8.11, 2.7 through 2.7.13, and earlier allows remote authenticated users to edit profile fields locked by the administrator.","status":"published","published":"2022-05-13T01:12:38Z","modified":"2024-04-23T23:41:13Z","cvss":[{"version":"3.0","score":6.5,"vector":"CVSS:3.0/AV:N/AC:L/PR:L/UI:N/S:U/C:N/I:H/A:N","level":"medium"}],"cwes":["CWE-284"],"updated_at":"2026-11-02T14:37:44.867253Z"}],"nvd":[{"id":"CVE-2016-3729","description":"The user editing form in Moodle 3.0 through 3.0.3, 2.9 through 2.9.5, 2.8 through 2.8.11, 2.7 through 2.7.13, and earlier allows remote authenticated users to edit profile fields locked by the administrator.","status":"published","published":"2017-04-20T21:59:00.717Z","modified":"2026-06-17T00:46:16.333Z","cvss":[{"version":"3.0","score":6.5,"vector":"CVSS:3.0/AV:N/AC:L/PR:L/UI:N/S:U/C:N/I:H/A:N","level":"medium","assessor":"primary"},{"version":"2.0","score":4,"vector":"AV:N/AC:L/Au:S/C:N/I:P/A:N","level":"medium","assessor":"primary"}],"cwes":["CWE-284"],"updated_at":"2026-11-02T14:03:37.619685Z"}],"osv":[{"id":"CVE-2016-3729","description":"The user editing form in Moodle 3.0 through 3.0.3, 2.9 through 2.9.5, 2.8 through 2.8.11, 2.7 through 2.7.13, and earlier allows remote authenticated users to edit profile fields locked by the administrator.","status":"published","published":"2017-04-20T21:59:00.717Z","modified":"2026-10-24T10:30:22.833090221Z","cvss":[{"version":"3.0","score":6.5,"vector":"CVSS:3.0/AV:N/AC:L/PR:L/UI:N/S:U/C:N/I:H/A:N","level":"medium"}],"updated_at":"2026-11-02T15:44:02.454775Z"},{"id":"GHSA-g96h-wvrm-c2ww","title":"Moodle Improper Access Control","description":"The user editing form in Moodle 3.0 through 3.0.3, 2.9 through 2.9.5, 2.8 through 2.8.11, 2.7 through 2.7.13, and earlier allows remote authenticated users to edit profile fields locked by the administrator.","status":"published","published":"2022-05-13T01:12:38Z","modified":"2024-04-23T23:58:47.961235Z","cvss":[{"version":"3.0","score":6.5,"vector":"CVSS:3.0/AV:N/AC:L/PR:L/UI:N/S:U/C:N/I:H/A:N","level":"medium"}],"cwes":["CWE-284"],"updated_at":"2026-11-02T15:46:47.472172Z"},{"id":"UBUNTU-CVE-2016-3729","description":"The user editing form in Moodle 3.0 through 3.0.3, 2.9 through 2.9.5, 2.8 through 2.8.11, 2.7 through 2.7.13, and earlier allows remote authenticated users to edit profile fields locked by the administrator.","status":"withdrawn","published":"2017-04-20T21:59:00Z","modified":"2025-07-16T07:34:23.673684Z","cvss":[{"version":"3.0","score":6.5,"vector":"CVSS:3.0/AV:N/AC:L/PR:L/UI:N/S:U/C:N/I:H/A:N","level":"medium"}],"updated_at":"2026-11-02T15:54:11.872222Z"}]}}