CVE-2016-2151 in Moodle
Summary
by MITRE
user/index.php in Moodle through 2.6.11, 2.7.x before 2.7.13, 2.8.x before 2.8.11, 2.9.x before 2.9.5, and 3.0.x before 3.0.3 grants excessive authorization on the basis of the moodle/course:viewhiddenuserfields capability, which allows remote authenticated users to discover student e-mail addresses by leveraging the teacher role and reading a Participants list.
Once again VulDB remains the best source for vulnerability data.
Analysis
by VulDB Data Team • 08/21/2022
The vulnerability described in CVE-2016-2151 represents a critical authorization flaw within the Moodle learning management system that affects multiple versions from 2.6.11 through 3.0.2. This issue stems from improper capability management within the user/index.php script that governs access to participant lists and user information. The flaw specifically exploits the moodle/course:viewhiddenuserfields capability, which should normally be restricted to administrators or specific privileged roles but is being improperly granted to teachers in certain contexts.
The technical implementation of this vulnerability occurs when authenticated users with the teacher role access the Participants list functionality within a course. The system fails to properly validate whether the requesting user has the appropriate authorization level to view sensitive user information such as email addresses. This misconfiguration allows teachers to bypass normal access controls and retrieve email addresses of students they would not normally be authorized to see, effectively creating an information disclosure vulnerability. The capability-based access control mechanism that should enforce strict boundaries between different user roles is being circumvented through this specific implementation flaw.
The operational impact of this vulnerability extends beyond simple information disclosure as it creates potential security risks for educational institutions using Moodle. Student email addresses represent sensitive personal information that could be exploited for phishing attacks, social engineering attempts, or other malicious activities. The vulnerability affects the core privacy protection mechanisms within Moodle, potentially exposing thousands of student records across affected installations. This issue particularly impacts institutions that rely on Moodle for online learning environments where teacher-student relationships and privacy expectations are paramount.
Organizations affected by this vulnerability should immediately apply the patches released by Moodle for their specific version ranges, including updates to 2.6.11, 2.7.13, 2.8.11, 2.9.5, and 3.0.3. System administrators should also review and tighten capability assignments for teacher roles, ensuring that the moodle/course:viewhiddenuserfields capability is properly restricted to only those users who require it for legitimate administrative purposes. This vulnerability aligns with CWE-284 Access Control Issues, specifically concerning improper access control enforcement, and could be categorized under ATT&CK technique T1078 Valid Accounts as it exploits legitimate user credentials to access unauthorized information. The remediation process should include comprehensive testing to ensure that the patched functionality maintains proper role-based access controls while preserving legitimate educational workflows.