CVE-2013-1831: Moodle reveals absolute path in exception message
lib/setuplib.php in Moodle through 2.1.10, 2.2.x before 2.2.8, 2.3.x before 2.3.5, and 2.4.x before 2.4.2 allows remote attackers to obtain sensitive information via an invalid request, which reveals the absolute path in an exception message.
Other sources
Moodle reveals absolute path in exception message
— Packagist
Affected Software
Remediation
Recommended actions to resolve this vulnerability, in priority order.
- Upgrade
Upgrade
composer/moodle/moodleto a version that resolves this vulnerability.Fixed in 2.4.2 - Upgrade
Upgrade
composer/moodle/moodleto a version that resolves this vulnerability.Fixed in 2.3.5 - Upgrade
Upgrade
composer/moodle/moodleto a version that resolves this vulnerability.Fixed in 2.2.8
Event History
Frequently Asked Questions
What is the severity of CVE-2013-1831?
CVE-2013-1831 has a medium severity rating due to the potential for sensitive information exposure.
How do I fix CVE-2013-1831?
To fix CVE-2013-1831, upgrade to Moodle version 2.4.2, 2.3.5, or 2.2.8 or later.
What type of vulnerability is CVE-2013-1831?
CVE-2013-1831 is an information disclosure vulnerability.
Which versions of Moodle are affected by CVE-2013-1831?
CVE-2013-1831 affects Moodle versions up to and including 2.1.10, as well as specific earlier versions of 2.2.x, 2.3.x, and 2.4.x.
What happens if I do not patch CVE-2013-1831?
Failing to patch CVE-2013-1831 could allow remote attackers to gain access to sensitive path information from the server.