CVE-2013-4522: Moodle vulnerable to Exposure of Sensitive Information to an Unauthorized Actor
lib/filelib.php in Moodle through 2.2.11, 2.3.x before 2.3.10, 2.4.x before 2.4.7, and 2.5.x before 2.5.3 does not send "Cache-Control: private" HTTP headers, which allows remote attackers to obtain sensitive information by requesting a file that had been previously retrieved by a caching proxy server.
Other sources
Moodle vulnerable to Exposure of Sensitive Information to an Unauthorized Actor
— Packagist
Affected Software
Remediation
Recommended actions to resolve this vulnerability, in priority order.
- Upgrade
Upgrade
composer/moodle/moodleto a version that resolves this vulnerability.Fixed in 2.5.3 - Upgrade
Upgrade
composer/moodle/moodleto a version that resolves this vulnerability.Fixed in 2.4.7 - Upgrade
Upgrade
composer/moodle/moodleto a version that resolves this vulnerability.Fixed in 2.3.10
Event History
Frequently Asked Questions
What is the severity of CVE-2013-4522?
CVE-2013-4522 has a medium severity as it may allow remote attackers to access sensitive information through improper caching.
How do I fix CVE-2013-4522?
To fix CVE-2013-4522, ensure that you update your Moodle installation to version 2.2.11, 2.3.10, 2.4.7, or 2.5.3 or later.
Which versions of Moodle are affected by CVE-2013-4522?
CVE-2013-4522 affects Moodle versions up to 2.2.11, all 2.3.x versions before 2.3.10, 2.4.x versions before 2.4.7, and 2.5.x versions before 2.5.3.
What type of vulnerability is CVE-2013-4522?
CVE-2013-4522 is a security vulnerability related to improper cache control in the Moodle file handling system.
Can CVE-2013-4522 compromise user data?
Yes, CVE-2013-4522 can potentially expose sensitive user data to unauthorized access due to the lack of 'Cache-Control: private' headers.