{"id":"CVE-2016-3732","aliases":["EUVD-2022-2475","GHSA-5282-96ff-xx3h","UBUNTU-CVE-2016-3732"],"status":"published","title":"Moodle sensitive information disclosure","description":"The capability check to access other badges in Moodle 3.0 through 3.0.3, 2.9 through 2.9.5, 2.8 through 2.8.11, 2.7 through 2.7.13, and earlier allows remote authenticated users to read the badges of other users.","severity":{"version":"3.0","score":4.3,"vector":"CVSS:3.0/AV:N/AC:L/PR:L/UI:N/S:U/C:L/I:N/A:N","level":"medium","assessor":"primary","from":"nvd"},"epss":{"day":"2026-11-08","score":0.01548,"percentile":0.75218,"model":"v2026.06.15"},"facts":{"in_kev":false,"known_exploited":false,"public_exploit":false,"fix_available":true},"cwes":["CWE-200"],"published":"2017-04-20T21:00:00Z","modified":"2026-10-24T10:30:47Z","fixes":[{"ecosystem":"Packagist","package":"moodle/moodle","fixed_in":["3.0.4","2.9.6","2.8.12","2.7.14"],"sources":["ghsa","osv"]}],"affected":[{"source":"ghsa","ecosystem":"Packagist","package":"moodle/moodle","ranges":[{"type":"ECOSYSTEM","events":[{"introduced":"3.0.0"},{"last_affected":"3.0.3"},{"fixed":"3.0.4"}]}]},{"source":"ghsa","ecosystem":"Packagist","package":"moodle/moodle","ranges":[{"type":"ECOSYSTEM","events":[{"introduced":"2.9.0"},{"last_affected":"2.9.5"},{"fixed":"2.9.6"}]}]},{"source":"ghsa","ecosystem":"Packagist","package":"moodle/moodle","ranges":[{"type":"ECOSYSTEM","events":[{"introduced":"2.8.0"},{"last_affected":"2.8.11"},{"fixed":"2.8.12"}]}]},{"source":"ghsa","ecosystem":"Packagist","package":"moodle/moodle","ranges":[{"type":"ECOSYSTEM","events":[{"introduced":"2.7.0"},{"last_affected":"2.7.13"},{"fixed":"2.7.14"}]}]},{"source":"osv","ecosystem":"Packagist","package":"moodle/moodle","ranges":[{"type":"ECOSYSTEM","events":[{"introduced":"3.0.0"},{"fixed":"3.0.4"}]}],"versions":["v3.0.0","v3.0.1","v3.0.2","v3.0.3"]},{"source":"osv","ecosystem":"Packagist","package":"moodle/moodle","ranges":[{"type":"ECOSYSTEM","events":[{"introduced":"2.9.0"},{"fixed":"2.9.6"}]}],"versions":["v2.9.0","v2.9.1","v2.9.2","v2.9.3","v2.9.4","v2.9.5"]},{"source":"osv","ecosystem":"Packagist","package":"moodle/moodle","ranges":[{"type":"ECOSYSTEM","events":[{"introduced":"2.8.0"},{"fixed":"2.8.12"}]}],"versions":["v2.8.0","v2.8.1","v2.8.10","v2.8.11","v2.8.2","v2.8.3","v2.8.4","v2.8.5","v2.8.6","v2.8.7","v2.8.8","v2.8.9"]},{"source":"osv","ecosystem":"Packagist","package":"moodle/moodle","ranges":[{"type":"ECOSYSTEM","events":[{"introduced":"2.7.0"},{"fixed":"2.7.14"}]}],"versions":["v2.7.0","v2.7.1","v2.7.10","v2.7.11","v2.7.12","v2.7.13","v2.7.2","v2.7.3","v2.7.4","v2.7.5","v2.7.6","v2.7.7","v2.7.8","v2.7.9"]},{"source":"osv","ecosystem":"Ubuntu:Pro:16.04:LTS","package":"moodle","ranges":[{"type":"ECOSYSTEM","events":[{"introduced":"0"}]}],"versions":["2.7.9+dfsg-1","2.7.10+dfsg-1","2.7.11+dfsg-1","2.7.11+dfsg-2","2.7.12+dfsg-1","3.0.3+dfsg-0ubuntu1","3.0.3+dfsg-0ubuntu1+esm1"]},{"source":"osv","ecosystem":"Ubuntu:Pro:18.04:LTS","package":"moodle","ranges":[{"type":"ECOSYSTEM","events":[{"introduced":"0"}]}],"versions":["3.0.3+dfsg-0ubuntu1","3.0.3+dfsg-0ubuntu1+esm1"]}],"products":[{"vendor":"moodle","product":"moodle"}],"references":[{"url":"http://www.openwall.com/lists/oss-security/2016/05/17/4","tags":["mailing-list","x_refsource_MLIST","x_transferred","Mailing List","Third Party Advisory","advisory","web"]},{"url":"https://bugzilla.redhat.com/show_bug.cgi?id=1335933","tags":["x_refsource_CONFIRM","x_transferred","Issue Tracking","Third Party Advisory","report","web"]},{"url":"http://www.securitytracker.com/id/1035902","tags":["vdb-entry","x_refsource_SECTRACK","x_transferred","Third Party Advisory","VDB Entry","advisory"]},{"url":"https://nvd.nist.gov/vuln/detail/CVE-2016-3732","tags":["advisory"]},{"url":"https://web.archive.org/web/20210413170947/http://www.securitytracker.com/id/1035902","tags":["web"]},{"url":"https://github.com/advisories/GHSA-5282-96ff-xx3h"},{"url":"https://github.com/moodle/moodle","tags":["package"]},{"url":"https://ubuntu.com/security/CVE-2016-3732","tags":["report"]},{"url":"https://www.cve.org/CVERecord?id=CVE-2016-3732","tags":["report"]}],"sources":{"cve":[{"id":"CVE-2016-3732","description":"The capability check to access other badges in Moodle 3.0 through 3.0.3, 2.9 through 2.9.5, 2.8 through 2.8.11, 2.7 through 2.7.13, and earlier allows remote authenticated users to read the badges of other users.","status":"published","published":"2017-04-20T21:00:00Z","modified":"2024-08-06T00:03:34.458Z","updated_at":"2026-11-02T14:33:33.758954Z"}],"euvd":[{"id":"EUVD-2022-2475","description":"The capability check to access other badges in Moodle 3.0 through 3.0.3, 2.9 through 2.9.5, 2.8 through 2.8.11, 2.7 through 2.7.13, and earlier allows remote authenticated users to read the badges of other users.","status":"published","published":"2017-04-20T21:00:00Z","modified":"2024-08-06T00:03:34Z","updated_at":"2026-11-03T02:22:49.109782Z"}],"ghsa":[{"id":"GHSA-5282-96ff-xx3h","title":"Moodle sensitive information disclosure","description":"The capability check to access other badges in Moodle 3.0 through 3.0.3, 2.9 through 2.9.5, 2.8 through 2.8.11, 2.7 through 2.7.13, and earlier allows remote authenticated users to read the badges of other users.","status":"published","published":"2022-05-13T01:12:38Z","modified":"2023-11-01T21:35:56Z","cvss":[{"version":"3.0","score":4.3,"vector":"CVSS:3.0/AV:N/AC:L/PR:L/UI:N/S:U/C:L/I:N/A:N","level":"medium"}],"cwes":["CWE-200"],"updated_at":"2026-11-02T14:37:11.48574Z"}],"nvd":[{"id":"CVE-2016-3732","description":"The capability check to access other badges in Moodle 3.0 through 3.0.3, 2.9 through 2.9.5, 2.8 through 2.8.11, 2.7 through 2.7.13, and earlier allows remote authenticated users to read the badges of other users.","status":"published","published":"2017-04-20T21:59:00.797Z","modified":"2026-06-17T00:46:16.57Z","cvss":[{"version":"3.0","score":4.3,"vector":"CVSS:3.0/AV:N/AC:L/PR:L/UI:N/S:U/C:L/I:N/A:N","level":"medium","assessor":"primary"},{"version":"2.0","score":4,"vector":"AV:N/AC:L/Au:S/C:P/I:N/A:N","level":"medium","assessor":"primary"}],"cwes":["CWE-200"],"updated_at":"2026-11-02T14:03:37.619685Z"}],"osv":[{"id":"CVE-2016-3732","description":"The capability check to access other badges in Moodle 3.0 through 3.0.3, 2.9 through 2.9.5, 2.8 through 2.8.11, 2.7 through 2.7.13, and earlier allows remote authenticated users to read the badges of other users.","status":"published","published":"2017-04-20T21:59:00.797Z","modified":"2026-10-24T10:30:47.815658783Z","cvss":[{"version":"3.0","score":4.3,"vector":"CVSS:3.0/AV:N/AC:L/PR:L/UI:N/S:U/C:L/I:N/A:N","level":"medium"}],"updated_at":"2026-11-02T15:44:02.454775Z"},{"id":"GHSA-5282-96ff-xx3h","title":"Moodle sensitive information disclosure","description":"The capability check to access other badges in Moodle 3.0 through 3.0.3, 2.9 through 2.9.5, 2.8 through 2.8.11, 2.7 through 2.7.13, and earlier allows remote authenticated users to read the badges of other users.","status":"published","published":"2022-05-13T01:12:38Z","modified":"2024-02-16T08:22:04.62219Z","cvss":[{"version":"3.0","score":4.3,"vector":"CVSS:3.0/AV:N/AC:L/PR:L/UI:N/S:U/C:L/I:N/A:N","level":"medium"}],"cwes":["CWE-200"],"updated_at":"2026-11-02T15:46:37.528068Z"},{"id":"UBUNTU-CVE-2016-3732","description":"The capability check to access other badges in Moodle 3.0 through 3.0.3, 2.9 through 2.9.5, 2.8 through 2.8.11, 2.7 through 2.7.13, and earlier allows remote authenticated users to read the badges of other users.","status":"published","published":"2017-04-20T21:59:00Z","modified":"2026-09-23T18:45:55.336468328Z","cvss":[{"version":"3.0","score":4.3,"vector":"CVSS:3.0/AV:N/AC:L/PR:L/UI:N/S:U/C:L/I:N/A:N","level":"medium"}],"updated_at":"2026-11-02T15:54:11.872222Z"}]}}