CVE-2016-7919 — HIGH (7.5) — White Hats Nepal

Vulnerability Description

Moodle 3.1.2 allows remote attackers to obtain sensitive information via unspecified vectors, related to a "SQL Injection" issue affecting the Administration panel function in the installation process component. NOTE: the vendor disputes the relevance of this report, noting that "the person who is installing Moodle must know database access credentials and they can access the database directly; there is no need for them to create a SQL injection in one of the installation dialogue fields.

CVSS Score

7.5

HIGH

CVSS:3.1/AV:N/AC:L/PR:N/UI:N/S:U/C:H/I:N/A:N

Attack Vector

NETWORK

Attack Complexity

LOW

Privileges Required

NONE

User Interaction

NONE

Scope

UNCHANGED

Confidentiality

HIGH

Integrity

NONE

Availability

NONE

Affected Products

Vendor	Product	Versions
Moodle	Moodle	3.1.2

Related Weaknesses (CWE)

CWE-89 CWE-200

References

http://www.securityfocus.com/bid/93971Third Party AdvisoryVDB Entry
https://tracker.moodle.org/browse/MDL-56298Issue Tracking
https://www.youtube.com/watch?v=pQS1GdQ3CBcExploitThird Party Advisory
http://www.securityfocus.com/bid/93971Third Party AdvisoryVDB Entry
https://tracker.moodle.org/browse/MDL-56298Issue Tracking
https://www.youtube.com/watch?v=pQS1GdQ3CBcExploitThird Party Advisory

FAQ

What is CVE-2016-7919?

CVE-2016-7919 is a vulnerability with a CVSS score of 7.5 (HIGH). Moodle 3.1.2 allows remote attackers to obtain sensitive information via unspecified vectors, related to a "SQL Injection" issue affecting the Administration panel function in the installation process...

How severe is CVE-2016-7919?

CVE-2016-7919 has been rated HIGH with a CVSS base score of 7.5/10. Review the CVSS metrics above for detailed severity breakdown.

Is there a patch for CVE-2016-7919?

Check the references section above for vendor advisories and patch information. Affected products include: Moodle Moodle.