CVE-2013-1836
First published: Mon Mar 25 2013(Updated: )
Moodle 2.x through 2.1.10, 2.2.x before 2.2.8, 2.3.x before 2.3.5, and 2.4.x before 2.4.2 does not properly manage privileges for WebDAV repositories, which allows remote authenticated users to read, modify, or delete arbitrary site-wide repositories by leveraging certain read access.
Credit: secalert@redhat.com
| Affected Software | Affected Version | How to fix |
|---|---|---|
| composer/moodle/moodle | >=2.4.0<2.4.2 | 2.4.2 |
| composer/moodle/moodle | >=2.3.0<2.3.5 | 2.3.5 |
| composer/moodle/moodle | >=2.0.0<2.2.8 | 2.2.8 |
| Moodle | =2.0.0 | |
| Moodle | =2.0.1 | |
| Moodle | =2.0.2 | |
| Moodle | =2.0.3 | |
| Moodle | =2.0.4 | |
| Moodle | =2.0.5 | |
| Moodle | =2.0.6 | |
| Moodle | =2.0.7 | |
| Moodle | =2.0.8 | |
| Moodle | =2.0.9 | |
| Moodle | =2.1.0 | |
| Moodle | =2.1.1 | |
| Moodle | =2.1.2 | |
| Moodle | =2.1.3 | |
| Moodle | =2.1.4 | |
| Moodle | =2.1.5 | |
| Moodle | =2.1.6 | |
| Moodle | =2.1.7 | |
| Moodle | =2.1.8 | |
| Moodle | =2.1.9 | |
| Moodle | =2.1.10 | |
| Moodle | =2.2.0 | |
| Moodle | =2.2.1 | |
| Moodle | =2.2.2 | |
| Moodle | =2.2.3 | |
| Moodle | =2.2.4 | |
| Moodle | =2.2.5 | |
| Moodle | =2.2.6 | |
| Moodle | =2.2.7 | |
| Moodle | =2.3.0 | |
| Moodle | =2.3.1 | |
| Moodle | =2.3.2 | |
| Moodle | =2.3.3 | |
| Moodle | =2.3.4 | |
| Moodle | =2.4.0 | |
| Moodle | =2.4.1 |
Never miss a vulnerability like this again
Sign up to SecAlerts for real-time vulnerability data matched to your software, aggregated from hundreds of sources.
Reference Links
- http://git.moodle.org/gw?p=moodle.git&a=search&h=HEAD&st=commit&s=MDL-37852
- http://lists.fedoraproject.org/pipermail/package-announce/2013-April/101310.html
- http://lists.fedoraproject.org/pipermail/package-announce/2013-April/101358.html
- http://openwall.com/lists/oss-security/2013/03/25/2
- https://moodle.org/mod/forum/discuss.php?d=225348
- https://nvd.nist.gov/vuln/detail/CVE-2013-1836
- https://github.com/moodle/moodle/commit/173a201f90941604ae1811a1b79089be4d78707c
- https://github.com/moodle/moodle/commit/67c858414acb6564cd11f27adb9ffc75e9c8ba7f
- https://github.com/moodle/moodle/commit/ac5fc5953426befb1232106ade9e42ff239d9b63
- https://github.com/moodle/moodle/commit/c512e94e7c972c2ef398d49283edbbdc0cfe8ea1
- https://github.com/moodle/moodle/commit/cb69d2584a0fda3f72cbb6974b155287bc6fcbab
- https://github.com/moodle/moodle/commit/d5a3a922679f9314ffdc7e4769d78e920e588457
- https://github.com/moodle/moodle/commit/e1be68f296addf57e80222e8a697931b0870c816
- https://github.com/advisories/GHSA-664q-mrxx-2x2v (Advisory)
Frequently Asked Questions
What is the severity of CVE-2013-1836?
CVE-2013-1836 is considered a medium severity vulnerability due to its potential for privilege escalation affecting WebDAV repositories in Moodle.
How do I fix CVE-2013-1836?
To fix CVE-2013-1836, upgrade Moodle to versions 2.4.2, 2.3.5, or 2.2.8 or later.
What systems are affected by CVE-2013-1836?
CVE-2013-1836 affects Moodle versions 2.0.0 to 2.4.1, specifically those versions prior to the patched versions mentioned.
Can CVE-2013-1836 be exploited remotely?
Yes, CVE-2013-1836 can be exploited by remote authenticated users who can gain unauthorized access to read, modify, or delete site-wide repositories.
What is the root cause of CVE-2013-1836?
The root cause of CVE-2013-1836 is improper management of privileges for WebDAV repositories in the affected versions of Moodle.
- agent/type
- collector/github-advisory-latest
- source/GitHub
- alias/GHSA-664q-mrxx-2x2v
- alias/CVE-2013-1836
- agent/software-canonical-lookup
- agent/weakness
- agent/severity
- agent/author
- agent/references
- agent/description
- agent/softwarecombine
- collector/github-advisory
- collector/mitre-cve
- source/MITRE
- agent/last-modified-date
- agent/first-publish-date
- agent/event
- agent/trending
- agent/source
- agent/tags
- collector/nvd-cve
- source/NVD
- agent/software-canonical-lookup-request
- collector/nvd-index
- package-manager/composer
- vendor/moodle
- canonical/moodle
- version/moodle/2.0.0
- version/moodle/2.0.1
- version/moodle/2.0.2
- version/moodle/2.0.3
- version/moodle/2.0.4
- version/moodle/2.0.5
- version/moodle/2.0.6
- version/moodle/2.0.7
- version/moodle/2.0.8
- version/moodle/2.0.9
- version/moodle/2.1.0
- version/moodle/2.1.1
- version/moodle/2.1.2
- version/moodle/2.1.3
- version/moodle/2.1.4
- version/moodle/2.1.5
- version/moodle/2.1.6
- version/moodle/2.1.7
- version/moodle/2.1.8
- version/moodle/2.1.9
- version/moodle/2.1.10
- version/moodle/2.2.0
- version/moodle/2.2.1
- version/moodle/2.2.2
- version/moodle/2.2.3
- version/moodle/2.2.4
- version/moodle/2.2.5
- version/moodle/2.2.6
- version/moodle/2.2.7
- version/moodle/2.3.0
- version/moodle/2.3.1
- version/moodle/2.3.2
- version/moodle/2.3.3
- version/moodle/2.3.4
- version/moodle/2.4.0
- version/moodle/2.4.1