CVE-2013-4522: Moodle Filelib.php Vulnerability Leading to Sensitive Information Exposure
Summary
CVE-2013-4522: Moodle vulnerable to Exposure of Sensitive Information to an Unauthorized Actor. Affects moodle/moodle across 3 version ranges.
< 2.3.10
>= 2.4.0-beta, < 2.4.7
>= 2.5.0-beta, < 2.5.3
Fixed in 2.3.10, 2.4.7 or 2.5.3, depending on the release line you run. How to fix ↓
Check if this vulnerability affects your application
Upload a manifest or SBOM and we'll show whether you're affected, plus every other risky package in the same scan.
No signup required · Results in about 60 seconds
Background
Moodle is an open-source learning platform designed to provide educators, administrators, and learners with a single robust, secure, and integrated system to create personalized learning environments. It is widely used in educational institutions for online learning and course management. However, certain versions of Moodle are vulnerable to a security issue that can expose sensitive information to unauthorized actors due to improper HTTP header management.
Vulnerability Detail
The vulnerability exists in the lib/filelib.php file of Moodle versions 2.2.11, 2.3.x before 2.3.10, 2.4.x before 2.4.7, and 2.5.x before 2.5.3. It fails to send 'Cache-Control: private' HTTP headers, which allows remote attackers to access sensitive information by retrieving files that were previously cached by a proxy server. This could lead to unauthorized access to private data, potentially compromising user privacy and security.
How To Fix
Fixed versions by release line
The minimum fixed version depends on the release line you run.
-
< 2.3.102.3.10composer require moodle/moodle:2.3.10 -
>= 2.4.0-beta, < 2.4.72.4.7composer require moodle/moodle:2.4.7 -
>= 2.5.0-beta, < 2.5.32.5.3composer require moodle/moodle:2.5.3
Tip — Not sure which release line you're on? Vulert can find the fix for the version you are using. Scan free →
Workaround
As a temporary workaround, you can configure your web server to add 'Cache-Control: private' headers for sensitive files. This can be done by adding the following lines to your server configuration:
<IfModule mod_headers.c>
Header set Cache-Control "private"
</IfModule>
Conclusion
The CVE-2013-4522 vulnerability in Moodle poses a significant risk by allowing unauthorized access to sensitive information due to improper HTTP header management. It is crucial to update to the latest patched versions to mitigate this risk and ensure the security of user data.
See every vulnerability recorded for moodle/moodle →
FAQ
Moodle versions 2.2.11, 2.3.x before 2.3.10, 2.4.x before 2.4.7, and 2.5.x before 2.5.3 are affected.
Sensitive information that may be exposed includes user data and files that were previously accessed and cached by a proxy server.
You can use Vulert's playground at Vulert Scanner to check if your application is affected by this vulnerability without requiring any signup.
Yes, you can configure your web server to add 'Cache-Control: private' headers for sensitive files as a temporary workaround.
Vulert monitors and alerts in real-time for open-source vulnerabilities in your software using just the composer.lock file, helping you maintain security without needing access to the code or installation.
Related vulnerabilities
Recent vulnerabilities recorded for moodle/moodle.
