CVE-2013-1833: Moodle Multiple cross-site scripting (XSS) vulnerabilities in the File Picker module
Moodle Multiple cross-site scripting (XSS) vulnerabilities in the File Picker module
Other sources
Multiple cross-site scripting (XSS) vulnerabilities in the File Picker module in Moodle 2.x through 2.1.10, 2.2.x before 2.2.8, 2.3.x before 2.3.5, and 2.4.x before 2.4.2 allow remote authenticated users to inject arbitrary web script or HTML via a crafted filename.
— GitHub
Affected Software
Remediation
Recommended actions to resolve this vulnerability, in priority order.
- Upgrade
Upgrade
composer/moodle/moodleto a version that resolves this vulnerability.Fixed in 2.4.2 - Upgrade
Upgrade
composer/moodle/moodleto a version that resolves this vulnerability.Fixed in 2.3.5 - Upgrade
Upgrade
composer/moodle/moodleto a version that resolves this vulnerability.Fixed in 2.2.8
Event History
Frequently Asked Questions
What is the severity of CVE-2013-1833?
CVE-2013-1833 has a medium severity rating due to its potential for XSS attacks.
How do I fix CVE-2013-1833?
To fix CVE-2013-1833, upgrade to Moodle versions 2.2.8, 2.3.5, or 2.4.2 or later.
Who is affected by CVE-2013-1833?
CVE-2013-1833 affects Moodle versions ranging from 2.0.0 through 2.1.10, 2.2.x before 2.2.8, 2.3.x before 2.3.5, and 2.4.x before 2.4.2.
What type of vulnerability is CVE-2013-1833?
CVE-2013-1833 is classified as a cross-site scripting (XSS) vulnerability.
Can CVE-2013-1833 be exploited by unauthenticated users?
No, CVE-2013-1833 can only be exploited by remote authenticated users.