PatchSiren

PatchSiren cyber security CVE debrief

CVE-2017-2576 Moodle CVE debrief

CVE-2017-2576 is a Medium-severity Moodle issue affecting forum handling in Moodle 2.x and 3.x. The flaw is described as incorrect sanitization of attributes in forums, which can lead to an integrity impact. NVD assigns CVSS 3.0 5.3 and classifies the weakness as CWE-20 (Improper Input Validation).

Vendor
Moodle
Product
Unknown
CVSS
MEDIUM 5.3
CISA KEV
Not listed in stored evidence
Original CVE published
2017-01-20
Original CVE updated
2026-05-13
Advisory published
2017-01-20
Advisory updated
2026-05-13

Who should care

Moodle administrators and developers who maintain forum functionality or run affected Moodle 2.x/3.x deployments should prioritize this issue, especially if their sites accept user-generated forum content.

Technical summary

The NVD record describes incorrect sanitization of attributes in Moodle forums. Its CVSS vector is AV:N/AC:L/PR:N/UI:N/S:U/C:N/I:L/A:N, indicating network-reachable exploitation with no privileges or user interaction required and a limited integrity impact. NVD maps vulnerable CPEs across Moodle 2.x and 3.x, including entries through 2.7.17, 2.8.x, 2.9.x, 3.0.x, 3.1.x, and 3.2.0.

Defensive priority

Medium. The issue is network-reachable and unauthenticated, but the recorded impact is limited to integrity. It still warrants prompt patching because it affects common forum functionality in multiple Moodle release lines.

Recommended defensive actions

  • Apply the Moodle vendor patch or upgrade to a fixed release referenced by the vendor advisory.
  • Review forum rendering and attribute validation paths in any custom plugins or theme overrides.
  • Use the NVD and vendor references to confirm whether your deployed Moodle version falls within the affected release set.
  • Check forum content workflows for unexpected attribute handling and remove unsafe content if needed.
  • Track the third-party advisory for additional remediation context and confirm your instance is no longer listed in the affected versions.

Evidence notes

The debrief is based on the official NVD CVE record and the vendor reference linked from the NVD entry. NVD states the vulnerability is incorrect sanitization of attributes in Moodle forums, assigns CVSS 3.0 5.3, maps CWE-20, and lists vulnerable Moodle CPEs. The vendor reference points to a Moodle forum advisory and patch discussion.

Sources and references

Verified primary and authoritative sources

  • CVE-2017-2576 CVE Program record

    Publisher, destination, and source semantics verified

    URL: https://www.cve.org/CVERecord?id=CVE-2017-2576

    CVE Program - Official CVE Program record with source-provided CVE metadata.

  • CVE-2017-2576 NVD vulnerability detail

    Publisher, destination, and source semantics verified

    URL: https://nvd.nist.gov/vuln/detail/CVE-2017-2576

    NIST National Vulnerability Database - Official NIST NVD detail page and source-specific vulnerability assessment.

Methodology and review provenance

AI-assisted synthesis based on stored public vulnerability evidence. System validation, approval state, and publication status do not by themselves establish human review of this revision. PatchSiren helps prioritize defensive review and does not prove exposure or remediation on any system.