CVE-2013-1829: Infoleak
Published Mar 25, 2013
·Updated
calendar/managesubscriptions.php in Moodle 2.4.x before 2.4.2 does not consider capability requirements before displaying calendar subscriptions, which allows remote authenticated users to obtain potentially sensitive information by leveraging the student role.
Affected Software
2 affected components
Moodle moodle=2.4.0
Moodle moodle=2.4.1
Remediation
Event History
Mar 25, 2013
CVE Published
via MITRE·09:00 PM
Data Sourced
via MITRE·09:00 PM
Description
Frequently Asked Questions
1
What is the severity of CVE-2013-1829?
CVE-2013-1829 is considered a medium severity vulnerability.
2
How does CVE-2013-1829 affect Moodle users?
CVE-2013-1829 allows remote authenticated users to access potentially sensitive information by exploiting inadequate capability checks.
3
Which versions of Moodle are affected by CVE-2013-1829?
CVE-2013-1829 affects Moodle versions 2.4.0 and 2.4.1.
4
How do I fix CVE-2013-1829?
To fix CVE-2013-1829, update your Moodle installation to version 2.4.2 or higher.
5
What is the exploit type for CVE-2013-1829?
CVE-2013-1829 is a vulnerability related to improper access controls in calendar subscriptions.