CVE-2013-2081: Moodle - Information Disclosure
Summary
CVE-2013-2081: Moodle does not consider "don't send" attributes during hub registration. Affects moodle/moodle across 3 version ranges.
< 2.2.10
>= 2.3.0, < 2.3.7
>= 2.4.0, < 2.4.4
Fixed in 2.2.10, 2.3.7 or 2.4.4, depending on the release line you run. How to fix ↓
Check if this vulnerability affects your application
Upload a manifest or SBOM and we'll show whether you're affected, plus every other risky package in the same scan.
No signup required · Results in about 60 seconds
Background
Moodle is an open-source learning management system (LMS) used by educational institutions worldwide. It provides a platform for creating and managing online courses, allowing educators to deliver content and interact with students. Moodle versions 2.1.10, 2.2.x before 2.2.10, 2.3.x before 2.3.7, and 2.4.x before 2.4.4 are affected by an information disclosure vulnerability.
Vulnerability Detail
The vulnerability in Moodle allows remote hubs to obtain sensitive site information by reading form data during hub registration. This occurs because Moodle does not consider "don't send" attributes, which should prevent certain data from being transmitted. As a result, remote hubs can access and extract sensitive information from the affected Moodle instances. The impact of this vulnerability can be significant, as it exposes confidential data that may include user credentials, course materials, and other sensitive information.
How To Fix
Fixed versions by release line
The minimum fixed version depends on the release line you run.
-
< 2.2.102.2.10composer require moodle/moodle:2.2.10 -
>= 2.3.0, < 2.3.72.3.7composer require moodle/moodle:2.3.7 -
>= 2.4.0, < 2.4.42.4.4composer require moodle/moodle:2.4.4
Tip — Not sure which release line you're on? Vulert can find the fix for the version you are using. Scan free →
Workaround
There is no specific workaround provided for this vulnerability. It is essential to apply the recommended fix by upgrading to the patched versions of Moodle.
Conclusion
The information disclosure vulnerability in Moodle can have serious consequences, exposing sensitive site information to remote hubs. It is crucial to upgrade to the latest patched versions of Moodle to mitigate this risk. For further assistance or support in vulnerability remediation, please contact DevNack.com.
See every vulnerability recorded for moodle/moodle →
FAQ
Moodle is an open-source learning management system (LMS) used by educational institutions to create and manage online courses.
Moodle versions 2.1.10, 2.2.x before 2.2.10, 2.3.x before 2.3.7, and 2.4.x before 2.4.4 are affected.
Remote hubs can exploit this vulnerability by reading form data during hub registration, allowing them to obtain sensitive site information.
The vulnerability can lead to the disclosure of sensitive information, including user credentials, course materials, and other confidential data.
To fix this vulnerability, upgrade to the latest patched versions of Moodle (2.2.10, 2.3.7, or 2.4.4).
References
Related vulnerabilities
Recent vulnerabilities recorded for moodle/moodle.
