CVE-2013-2082: Moodle does not enforce capability requirements for reading blog comments
Moodle does not enforce capability requirements for reading blog comments
Other sources
Moodle through 2.1.10, 2.2.x before 2.2.10, 2.3.x before 2.3.7, and 2.4.x before 2.4.4 does not enforce capability requirements for reading blog comments, which allows remote attackers to obtain sensitive information via a crafted request.
— GitHub
Affected Software
Remediation
Recommended actions to resolve this vulnerability, in priority order.
- Upgrade
Upgrade
composer/moodle/moodleto a version that resolves this vulnerability.Fixed in 2.4.4 - Upgrade
Upgrade
composer/moodle/moodleto a version that resolves this vulnerability.Fixed in 2.3.7 - Upgrade
Upgrade
composer/moodle/moodleto a version that resolves this vulnerability.Fixed in 2.2.10
Event History
Frequently Asked Questions
What is the severity of CVE-2013-2082?
CVE-2013-2082 has a medium severity rating due to the potential for unauthorized access to sensitive information.
How do I fix CVE-2013-2082?
To fix CVE-2013-2082, upgrade to Moodle versions 2.2.10, 2.3.7, or 2.4.4 or later.
What versions are affected by CVE-2013-2082?
CVE-2013-2082 affects Moodle versions through 2.1.10, 2.2.x before 2.2.10, 2.3.x before 2.3.7, and 2.4.x before 2.4.4.
Can CVE-2013-2082 be exploited remotely?
Yes, CVE-2013-2082 can be exploited remotely by attackers through crafted requests.
What kind of information can be exposed due to CVE-2013-2082?
CVE-2013-2082 may expose sensitive information contained in blog comments.