Search for vulnerabilities
Vulnerability details: VCID-gw9n-3aqw-qqg7
Vulnerability ID VCID-gw9n-3aqw-qqg7
Aliases CVE-2016-2155
GHSA-32hg-73hp-vwc8
Summary Moodle allows attackers to modify "Exclude grade" settings The grade-reporting feature in Singleview (aka Single View) in Moodle 2.8.x before 2.8.11, 2.9.x before 2.9.5, and 3.0.x before 3.0.3 does not consider the moodle/grade:manage capability, which allows remote authenticated users to modify "Exclude grade" settings by leveraging the Non-Editing Instructor role.
Status Published
Exploitability 0.5
Weighted Severity 6.2
Risk 3.1
Affected and Fixed Packages Package Details
Weaknesses (3)
CWE-1035 OWASP Top Ten 2017 Category A9 - Using Components with Known Vulnerabilities
CWE-264 Permissions, Privileges, and Access Controls
CWE-937 OWASP Top Ten 2013 Category A9 - Using Components with Known Vulnerabilities
System Score Found at
cvssv3.1 4.3 http://git.moodle.org/gw?p=moodle.git&a=search&h=HEAD&st=commit&s=MDL-52378
generic_textual MODERATE http://git.moodle.org/gw?p=moodle.git&a=search&h=HEAD&st=commit&s=MDL-52378
epss 0.00284 https://api.first.org/data/v1/epss?cve=CVE-2016-2155
epss 0.00284 https://api.first.org/data/v1/epss?cve=CVE-2016-2155
cvssv3.1_qr MODERATE https://github.com/advisories/GHSA-32hg-73hp-vwc8
cvssv3.1 4.3 https://github.com/moodle/moodle
generic_textual MODERATE https://github.com/moodle/moodle
cvssv3.1 4.3 https://github.com/moodle/moodle/commit/3328dc32a75d6aa4bc92865fa236dc6d52dcb7bf
generic_textual MODERATE https://github.com/moodle/moodle/commit/3328dc32a75d6aa4bc92865fa236dc6d52dcb7bf
cvssv3.1 4.3 https://github.com/moodle/moodle/commit/5208032b23b7999d7048a3da7a4b70c038d93506
generic_textual MODERATE https://github.com/moodle/moodle/commit/5208032b23b7999d7048a3da7a4b70c038d93506
cvssv3.1 4.3 https://github.com/moodle/moodle/commit/71beedee8c82c378ed10a0569c8b19ec641df9e3
generic_textual MODERATE https://github.com/moodle/moodle/commit/71beedee8c82c378ed10a0569c8b19ec641df9e3
cvssv3.1 4.3 https://github.com/moodle/moodle/commit/ad67b7eeea4abf194eb432d5958e9a7032ee2c25
generic_textual MODERATE https://github.com/moodle/moodle/commit/ad67b7eeea4abf194eb432d5958e9a7032ee2c25
cvssv3.1 4.3 https://github.com/moodle/moodle/commit/ae66ed23b6ae8000efd4e1f612697892c9795c65
generic_textual MODERATE https://github.com/moodle/moodle/commit/ae66ed23b6ae8000efd4e1f612697892c9795c65
cvssv3.1 4.3 https://github.com/moodle/moodle/commit/b74d0f8404651d9ad0d97fd7eb58a94079342eb3
generic_textual MODERATE https://github.com/moodle/moodle/commit/b74d0f8404651d9ad0d97fd7eb58a94079342eb3
cvssv3.1 4.3 https://github.com/moodle/moodle/commit/c7f7b18adecb4a80c4f3defee31e72e591133693
generic_textual MODERATE https://github.com/moodle/moodle/commit/c7f7b18adecb4a80c4f3defee31e72e591133693
cvssv3.1 4.3 https://moodle.org/mod/forum/discuss.php?d=330177
generic_textual MODERATE https://moodle.org/mod/forum/discuss.php?d=330177
cvssv3.1 4.3 https://nvd.nist.gov/vuln/detail/CVE-2016-2155
generic_textual MODERATE https://nvd.nist.gov/vuln/detail/CVE-2016-2155
cvssv3.1 4.3 https://web.archive.org/web/20160424224349/http://www.securitytracker.com/id/1035333
generic_textual MODERATE https://web.archive.org/web/20160424224349/http://www.securitytracker.com/id/1035333
cvssv3.1 4.3 http://www.openwall.com/lists/oss-security/2016/03/21/1
generic_textual MODERATE http://www.openwall.com/lists/oss-security/2016/03/21/1
Reference id Reference type URL
http://git.moodle.org/gw?p=moodle.git&a=search&h=HEAD&st=commit&s=MDL-52378
https://api.first.org/data/v1/epss?cve=CVE-2016-2155
https://github.com/moodle/moodle
https://github.com/moodle/moodle/commit/3328dc32a75d6aa4bc92865fa236dc6d52dcb7bf
https://github.com/moodle/moodle/commit/5208032b23b7999d7048a3da7a4b70c038d93506
https://github.com/moodle/moodle/commit/71beedee8c82c378ed10a0569c8b19ec641df9e3
https://github.com/moodle/moodle/commit/ad67b7eeea4abf194eb432d5958e9a7032ee2c25
https://github.com/moodle/moodle/commit/ae66ed23b6ae8000efd4e1f612697892c9795c65
https://github.com/moodle/moodle/commit/b74d0f8404651d9ad0d97fd7eb58a94079342eb3
https://github.com/moodle/moodle/commit/c7f7b18adecb4a80c4f3defee31e72e591133693
https://moodle.org/mod/forum/discuss.php?d=330177
https://nvd.nist.gov/vuln/detail/CVE-2016-2155
https://web.archive.org/web/20160424224349/http://www.securitytracker.com/id/1035333
http://www.openwall.com/lists/oss-security/2016/03/21/1
GHSA-32hg-73hp-vwc8 https://github.com/advisories/GHSA-32hg-73hp-vwc8
No exploits are available.
Vector: CVSS:3.0/AV:N/AC:L/PR:L/UI:N/S:U/C:N/I:L/A:N Found at http://git.moodle.org/gw?p=moodle.git&a=search&h=HEAD&st=commit&s=MDL-52378
Attack Vector (AV) Attack Complexity (AC) Privileges Required (PR) User Interaction (UI) Scope (S) Confidentiality Impact (C) Integrity Impact (I) Availability Impact (A)

network

adjacent_network

local

physical

low

high

none

low

high

none

required

unchanged

changed

high

low

none

high

low

none

high

low

none
Vector: CVSS:3.0/AV:N/AC:L/PR:L/UI:N/S:U/C:N/I:L/A:N Found at https://github.com/moodle/moodle
Attack Vector (AV) Attack Complexity (AC) Privileges Required (PR) User Interaction (UI) Scope (S) Confidentiality Impact (C) Integrity Impact (I) Availability Impact (A)

network

adjacent_network

local

physical

low

high

none

low

high

none

required

unchanged

changed

high

low

none

high

low

none

high

low

none
Vector: CVSS:3.0/AV:N/AC:L/PR:L/UI:N/S:U/C:N/I:L/A:N Found at https://github.com/moodle/moodle/commit/3328dc32a75d6aa4bc92865fa236dc6d52dcb7bf
Attack Vector (AV) Attack Complexity (AC) Privileges Required (PR) User Interaction (UI) Scope (S) Confidentiality Impact (C) Integrity Impact (I) Availability Impact (A)

network

adjacent_network

local

physical

low

high

none

low

high

none

required

unchanged

changed

high

low

none

high

low

none

high

low

none
Vector: CVSS:3.0/AV:N/AC:L/PR:L/UI:N/S:U/C:N/I:L/A:N Found at https://github.com/moodle/moodle/commit/5208032b23b7999d7048a3da7a4b70c038d93506
Attack Vector (AV) Attack Complexity (AC) Privileges Required (PR) User Interaction (UI) Scope (S) Confidentiality Impact (C) Integrity Impact (I) Availability Impact (A)

network

adjacent_network

local

physical

low

high

none

low

high

none

required

unchanged

changed

high

low

none

high

low

none

high

low

none
Vector: CVSS:3.0/AV:N/AC:L/PR:L/UI:N/S:U/C:N/I:L/A:N Found at https://github.com/moodle/moodle/commit/71beedee8c82c378ed10a0569c8b19ec641df9e3
Attack Vector (AV) Attack Complexity (AC) Privileges Required (PR) User Interaction (UI) Scope (S) Confidentiality Impact (C) Integrity Impact (I) Availability Impact (A)

network

adjacent_network

local

physical

low

high

none

low

high

none

required

unchanged

changed

high

low

none

high

low

none

high

low

none
Vector: CVSS:3.0/AV:N/AC:L/PR:L/UI:N/S:U/C:N/I:L/A:N Found at https://github.com/moodle/moodle/commit/ad67b7eeea4abf194eb432d5958e9a7032ee2c25
Attack Vector (AV) Attack Complexity (AC) Privileges Required (PR) User Interaction (UI) Scope (S) Confidentiality Impact (C) Integrity Impact (I) Availability Impact (A)

network

adjacent_network

local

physical

low

high

none

low

high

none

required

unchanged

changed

high

low

none

high

low

none

high

low

none
Vector: CVSS:3.0/AV:N/AC:L/PR:L/UI:N/S:U/C:N/I:L/A:N Found at https://github.com/moodle/moodle/commit/ae66ed23b6ae8000efd4e1f612697892c9795c65
Attack Vector (AV) Attack Complexity (AC) Privileges Required (PR) User Interaction (UI) Scope (S) Confidentiality Impact (C) Integrity Impact (I) Availability Impact (A)

network

adjacent_network

local

physical

low

high

none

low

high

none

required

unchanged

changed

high

low

none

high

low

none

high

low

none
Vector: CVSS:3.0/AV:N/AC:L/PR:L/UI:N/S:U/C:N/I:L/A:N Found at https://github.com/moodle/moodle/commit/b74d0f8404651d9ad0d97fd7eb58a94079342eb3
Attack Vector (AV) Attack Complexity (AC) Privileges Required (PR) User Interaction (UI) Scope (S) Confidentiality Impact (C) Integrity Impact (I) Availability Impact (A)

network

adjacent_network

local

physical

low

high

none

low

high

none

required

unchanged

changed

high

low

none

high

low

none

high

low

none
Vector: CVSS:3.0/AV:N/AC:L/PR:L/UI:N/S:U/C:N/I:L/A:N Found at https://github.com/moodle/moodle/commit/c7f7b18adecb4a80c4f3defee31e72e591133693
Attack Vector (AV) Attack Complexity (AC) Privileges Required (PR) User Interaction (UI) Scope (S) Confidentiality Impact (C) Integrity Impact (I) Availability Impact (A)

network

adjacent_network

local

physical

low

high

none

low

high

none

required

unchanged

changed

high

low

none

high

low

none

high

low

none
Vector: CVSS:3.0/AV:N/AC:L/PR:L/UI:N/S:U/C:N/I:L/A:N Found at https://moodle.org/mod/forum/discuss.php?d=330177
Attack Vector (AV) Attack Complexity (AC) Privileges Required (PR) User Interaction (UI) Scope (S) Confidentiality Impact (C) Integrity Impact (I) Availability Impact (A)

network

adjacent_network

local

physical

low

high

none

low

high

none

required

unchanged

changed

high

low

none

high

low

none

high

low

none
Vector: CVSS:3.0/AV:N/AC:L/PR:L/UI:N/S:U/C:N/I:L/A:N Found at https://nvd.nist.gov/vuln/detail/CVE-2016-2155
Attack Vector (AV) Attack Complexity (AC) Privileges Required (PR) User Interaction (UI) Scope (S) Confidentiality Impact (C) Integrity Impact (I) Availability Impact (A)

network

adjacent_network

local

physical

low

high

none

low

high

none

required

unchanged

changed

high

low

none

high

low

none

high

low

none
Vector: CVSS:3.0/AV:N/AC:L/PR:L/UI:N/S:U/C:N/I:L/A:N Found at https://web.archive.org/web/20160424224349/http://www.securitytracker.com/id/1035333
Attack Vector (AV) Attack Complexity (AC) Privileges Required (PR) User Interaction (UI) Scope (S) Confidentiality Impact (C) Integrity Impact (I) Availability Impact (A)

network

adjacent_network

local

physical

low

high

none

low

high

none

required

unchanged

changed

high

low

none

high

low

none

high

low

none
Vector: CVSS:3.0/AV:N/AC:L/PR:L/UI:N/S:U/C:N/I:L/A:N Found at http://www.openwall.com/lists/oss-security/2016/03/21/1
Attack Vector (AV) Attack Complexity (AC) Privileges Required (PR) User Interaction (UI) Scope (S) Confidentiality Impact (C) Integrity Impact (I) Availability Impact (A)

network

adjacent_network

local

physical

low

high

none

low

high

none

required

unchanged

changed

high

low

none

high

low

none

high

low

none
Exploit Prediction Scoring System (EPSS)
Percentile 0.51397
EPSS Score 0.00284
Published At June 30, 2025, 12:55 p.m.
Date Actor Action Source VulnerableCode Version
2025-07-01T12:26:54.636637+00:00 GithubOSV Importer Import https://github.com/github/advisory-database/blob/main/advisories/github-reviewed/2022/05/GHSA-32hg-73hp-vwc8/GHSA-32hg-73hp-vwc8.json 36.1.3