Search for vulnerabilities
Vulnerability details: VCID-8wm1-kecn-6qg8
Vulnerability ID VCID-8wm1-kecn-6qg8
Aliases CVE-2016-8642
GHSA-x32v-7qw8-cpq8
Summary Moodle Unauthenticated Access In Moodle 2.x and 3.x, the question engine allows access to files that should not be available.
Status Published
Exploitability 0.5
Weighted Severity 6.2
Risk 3.1
Affected and Fixed Packages Package Details
Weaknesses (3)
CWE-284 Improper Access Control
CWE-1035 OWASP Top Ten 2017 Category A9 - Using Components with Known Vulnerabilities
CWE-937 OWASP Top Ten 2013 Category A9 - Using Components with Known Vulnerabilities
System Score Found at
epss 0.00222 https://api.first.org/data/v1/epss?cve=CVE-2016-8642
epss 0.00222 https://api.first.org/data/v1/epss?cve=CVE-2016-8642
cvssv3.1_qr MODERATE https://github.com/advisories/GHSA-x32v-7qw8-cpq8
cvssv3.1 5.3 https://github.com/moodle/moodle
generic_textual MODERATE https://github.com/moodle/moodle
cvssv3.1 5.3 https://github.com/moodle/moodle/commit/cf0b9432d81ba9d5763e4894f82c95ca9fbf548f
generic_textual MODERATE https://github.com/moodle/moodle/commit/cf0b9432d81ba9d5763e4894f82c95ca9fbf548f
cvssv3.1 5.3 https://moodle.org/mod/forum/discuss.php?d=343275
generic_textual MODERATE https://moodle.org/mod/forum/discuss.php?d=343275
cvssv3.1 5.3 https://nvd.nist.gov/vuln/detail/CVE-2016-8642
generic_textual MODERATE https://nvd.nist.gov/vuln/detail/CVE-2016-8642
cvssv3.1 5.3 https://web.archive.org/web/20210123193602/http://www.securityfocus.com/bid/94441
generic_textual MODERATE https://web.archive.org/web/20210123193602/http://www.securityfocus.com/bid/94441
Reference id Reference type URL
https://api.first.org/data/v1/epss?cve=CVE-2016-8642
https://github.com/moodle/moodle
https://github.com/moodle/moodle/commit/cf0b9432d81ba9d5763e4894f82c95ca9fbf548f
https://moodle.org/mod/forum/discuss.php?d=343275
https://nvd.nist.gov/vuln/detail/CVE-2016-8642
https://web.archive.org/web/20210123193602/http://www.securityfocus.com/bid/94441
GHSA-x32v-7qw8-cpq8 https://github.com/advisories/GHSA-x32v-7qw8-cpq8
No exploits are available.
Vector: CVSS:3.0/AV:N/AC:L/PR:N/UI:N/S:U/C:L/I:N/A:N Found at https://github.com/moodle/moodle
Attack Vector (AV) Attack Complexity (AC) Privileges Required (PR) User Interaction (UI) Scope (S) Confidentiality Impact (C) Integrity Impact (I) Availability Impact (A)

network

adjacent_network

local

physical

low

high

none

low

high

none

required

unchanged

changed

high

low

none

high

low

none

high

low

none
Vector: CVSS:3.0/AV:N/AC:L/PR:N/UI:N/S:U/C:L/I:N/A:N Found at https://github.com/moodle/moodle/commit/cf0b9432d81ba9d5763e4894f82c95ca9fbf548f
Attack Vector (AV) Attack Complexity (AC) Privileges Required (PR) User Interaction (UI) Scope (S) Confidentiality Impact (C) Integrity Impact (I) Availability Impact (A)

network

adjacent_network

local

physical

low

high

none

low

high

none

required

unchanged

changed

high

low

none

high

low

none

high

low

none
Vector: CVSS:3.0/AV:N/AC:L/PR:N/UI:N/S:U/C:L/I:N/A:N Found at https://moodle.org/mod/forum/discuss.php?d=343275
Attack Vector (AV) Attack Complexity (AC) Privileges Required (PR) User Interaction (UI) Scope (S) Confidentiality Impact (C) Integrity Impact (I) Availability Impact (A)

network

adjacent_network

local

physical

low

high

none

low

high

none

required

unchanged

changed

high

low

none

high

low

none

high

low

none
Vector: CVSS:3.0/AV:N/AC:L/PR:N/UI:N/S:U/C:L/I:N/A:N Found at https://nvd.nist.gov/vuln/detail/CVE-2016-8642
Attack Vector (AV) Attack Complexity (AC) Privileges Required (PR) User Interaction (UI) Scope (S) Confidentiality Impact (C) Integrity Impact (I) Availability Impact (A)

network

adjacent_network

local

physical

low

high

none

low

high

none

required

unchanged

changed

high

low

none

high

low

none

high

low

none
Vector: CVSS:3.0/AV:N/AC:L/PR:N/UI:N/S:U/C:L/I:N/A:N Found at https://web.archive.org/web/20210123193602/http://www.securityfocus.com/bid/94441
Attack Vector (AV) Attack Complexity (AC) Privileges Required (PR) User Interaction (UI) Scope (S) Confidentiality Impact (C) Integrity Impact (I) Availability Impact (A)

network

adjacent_network

local

physical

low

high

none

low

high

none

required

unchanged

changed

high

low

none

high

low

none

high

low

none
Exploit Prediction Scoring System (EPSS)
Percentile 0.44844
EPSS Score 0.00222
Published At June 30, 2025, 12:55 p.m.
Date Actor Action Source VulnerableCode Version
2025-07-01T12:28:05.398986+00:00 GithubOSV Importer Import https://github.com/github/advisory-database/blob/main/advisories/github-reviewed/2022/05/GHSA-x32v-7qw8-cpq8/GHSA-x32v-7qw8-cpq8.json 36.1.3