CVE-2013-2079: Medium severity moodle vulnerability

Published May 25, 2013

Updated

mod/assign/locallib.php in the assignment module in Moodle 2.3.x before 2.3.7 and 2.4.x before 2.4.4 does not consider capability requirements during the processing of ZIP assignment-archive download (aka downloadall) requests, which allows remote authenticated users to read other users' assignments by leveraging the student role.

Affected Software

11 affected components

Moodle moodle=2.3.0

Moodle moodle=2.3.1

Moodle moodle=2.3.2

Moodle moodle=2.3.3

Moodle moodle=2.3.4

Moodle moodle=2.3.5

Moodle moodle=2.3.6

Moodle moodle=2.4.0

Moodle moodle=2.4.1

Moodle moodle=2.4.2

Moodle moodle=2.4.3

Remediation

Patch Available

http://git.moodle.org/gw?p=moodle.git&a=search&h=HEAD&st=commit&s=MDL-38443

Event History

May 25, 2013

CVE Published

via MITRE·01:00 AM

Data Sourced

via MITRE·01:00 AM

Description

Frequently Asked Questions

What is the severity of CVE-2013-2079?

CVE-2013-2079 is classified as a high severity vulnerability due to its potential to allow unauthorized access to other users' assignment submissions.

How do I fix CVE-2013-2079?

To fix CVE-2013-2079, upgrade to Moodle versions 2.3.7 or 2.4.4 or later where the vulnerability has been addressed.

Who is affected by CVE-2013-2079?

Users of Moodle versions 2.3.0 through 2.3.6 and 2.4.0 through 2.4.3 are affected by CVE-2013-2079.

What type of attack does CVE-2013-2079 facilitate?

CVE-2013-2079 facilitates unauthorized access, allowing remote authenticated users to read other users' assignment submissions.

What component of Moodle is impacted by CVE-2013-2079?

CVE-2013-2079 impacts the assignment module, specifically the handling of ZIP assignment-archive download requests.