PatchSiren

PatchSiren cyber security CVE debrief

CVE-2016-8642 Moodle CVE debrief

CVE-2016-8642 is a Moodle access control weakness in the question engine that can allow access to files that should not be available. NVD rates it medium severity (CVSS 5.3) with network attack, no privileges, and no user interaction required, and the impact is limited to confidentiality. The record was published on 2017-01-20 and later modified on 2026-05-13.

Vendor
Moodle
Product
Unknown
CVSS
MEDIUM 5.3
CISA KEV
Not listed in stored evidence
Original CVE published
2017-01-20
Original CVE updated
2026-05-13
Advisory published
2017-01-20
Advisory updated
2026-05-13

Who should care

Moodle administrators, LMS security teams, and organizations that use Moodle for coursework, exams, or internal training should review this issue, especially where file access controls matter.

Technical summary

NVD maps this issue to CWE-284 (Improper Access Control). The vulnerability affects multiple Moodle release lines in the 2.x and 3.x series, including versions up to 2.7.16 and specific builds in 2.8.x, 2.9.x, 3.0.x, and 3.1.x as listed by NVD. The published CVSS v3.0 vector is CVSS:3.0/AV:N/AC:L/PR:N/UI:N/S:U/C:L/I:N/A:N, indicating an unauthenticated network attacker could access restricted files without affecting integrity or availability.

Defensive priority

Medium. Prioritize if your Moodle deployment includes any affected versions or if restricted course, quiz, or user-upload files would create privacy or compliance exposure.

Recommended defensive actions

  • Check your Moodle instance against the affected version ranges listed in NVD for CVE-2016-8642.
  • Apply the vendor-referenced Moodle patch or upgrade to a fixed release if you are on an affected build.
  • Review question engine and file-serving permissions to confirm only intended users can reach protected content.
  • Audit logs for unusual file access patterns around quiz/question activity.
  • If immediate patching is delayed, restrict exposure of the Moodle instance and minimize access to sensitive file repositories.

Evidence notes

Source corpus shows the vulnerability description as 'In Moodle 2.x and 3.x, the question engine allows access to files that should not be available.' NVD references a Moodle vendor advisory (https://moodle.org/mod/forum/discuss.php?d=343275) and a SecurityFocus BID entry (http://www.securityfocus.com/bid/94441). NVD also lists affected Moodle CPE ranges spanning 2.x and 3.x release lines, and identifies CWE-284 with CVSS v3.0 AV:N/AC:L/PR:N/UI:N/S:U/C:L/I:N/A:N.

Sources and references

Verified primary and authoritative sources

  • CVE-2016-8642 CVE Program record

    Publisher, destination, and source semantics verified

    URL: https://www.cve.org/CVERecord?id=CVE-2016-8642

    CVE Program - Official CVE Program record with source-provided CVE metadata.

  • CVE-2016-8642 NVD vulnerability detail

    Publisher, destination, and source semantics verified

    URL: https://nvd.nist.gov/vuln/detail/CVE-2016-8642

    NIST National Vulnerability Database - Official NIST NVD detail page and source-specific vulnerability assessment.

Methodology and review provenance

AI-assisted synthesis based on stored public vulnerability evidence. System validation, approval state, and publication status do not by themselves establish human review of this revision. PatchSiren helps prioritize defensive review and does not prove exposure or remediation on any system.