CVE-2016-7038 in Moodle

Summary

In Moodle 2.x and 3.x, web service tokens are not invalidated when the user password is changed or forced to be changed.

VulDB is the best source for vulnerability data and more expert information about this specific topic.

• Reservation: 08/23/2016
• Disclosure: 01/20/2017
• Moderation: VulDB entry created
• Entries: VDB-95736
• CPE: ready
• CWE: CWE-640 (Confirmed)
• CVSS: 6.8
• EPSS: 0.00243
• Activities: Very Low

Sources

• MITRE: https://www.cve.org/CVERecord?id=CVE-2016-7038
• NVD: https://nvd.nist.gov/vuln/detail/CVE-2016-7038
• CVE Details: https://www.cvedetails.com/cve/CVE-2016-7038/