Moodle allows attackers to modify "Exclude grade" settings

MEDIUM 4.3CVE-2016-2155 · GHSA-32hg-73hp-vwc8 · Published 22/05/2016 · updated 17/06/2026

In short

CVE-2016-2155 is a MEDIUM (CVSS 4.3) vulnerability affecting moodle/moodle, moodle (moodle).
Chance of exploitation in the next 30 days (EPSS): 1.6%, higher than 76.0% of all vulnerabilities.
Fix: update to 2.8.11, 2.9.5, 3.0.3 or later.

Package	Affected versions	Patched versions
moodle/moodle Packagist	`≥ 2.8.0, < 2.8.11≥ 2.9.0, < 2.9.5≥ 3.0.0, < 3.0.3`	`2.8.112.9.53.0.3`
moodle moodle	`= 2.8.0= 2.8.1= 2.8.10= 2.8.2= 2.8.3= 2.8.4= 2.8.5= 2.8.6= 2.8.7= 2.8.8= 2.8.9= 2.9.0= 2.9.1= 2.9.2= 2.9.3= 2.9.4= 3.0.0= 3.0.1= 3.0.2`	No fix yet

Description

The grade-reporting feature in Singleview (aka Single View) in Moodle 2.8.x before 2.8.11, 2.9.x before 2.9.5, and 3.0.x before 3.0.3 does not consider the moodle/grade:manage capability, which allows remote authenticated users to modify "Exclude grade" settings by leveraging the Non-Editing Instructor role.

NVD description

References

nvd.nist.gov/vuln/detail/CVE-2016-2155 · ADVISORY
moodle/moodle commit 3328dc3 · WEB
moodle/moodle commit 5208032 · WEB
moodle/moodle commit 71beede · WEB
moodle/moodle commit ad67b7e · WEB
moodle/moodle commit ae66ed2 · WEB
moodle/moodle commit b74d0f8 · WEB
moodle/moodle commit c7f7b18 · WEB
moodle/moodle · PACKAGE
moodle.org/mod/forum/discuss.php · WEB
web.archive.org/web/20160424224349/http://www.securitytracker.com/id/1035333

More vulnerabilities in moodle/moodle

See all →

Running one of these products? Scan your site to see whether it exposes a vulnerable version.

Scan my site free

Package

Affected versions

Patched versions

moodle/moodle

Packagist

≥ 2.8.0, < 2.8.11≥ 2.9.0, < 2.9.5≥ 3.0.0, < 3.0.3

2.8.112.9.53.0.3

moodle

= 2.8.0= 2.8.1= 2.8.10= 2.8.2= 2.8.3= 2.8.4= 2.8.5= 2.8.6= 2.8.7= 2.8.8= 2.8.9= 2.9.0= 2.9.1= 2.9.2= 2.9.3= 2.9.4= 3.0.0= 3.0.1= 3.0.2

No fix yet

Description

NVD description

More vulnerabilities in moodle/moodle

See all →