CVE-2013-2081 json
Moodle does not consider "don't send" attributes during hub registration
published 13y ago modified 4mo ago also GHSA-x3x8-fjw6-hccx , EUVD-2022-5705
- cvss
- 4.3
- version 2.0, NVD
- cisa kev
- Not listed
- not in CISA's catalog
- epss
- 1.5%
- EPSS 1.5% chance of exploitation in 30 days, percentile 75%
- public exploits
- 0
- none known
Summary
Moodle through 2.1.10, 2.2.x before 2.2.10, 2.3.x before 2.3.7, and 2.4.x before 2.4.4 does not consider "don't send" attributes during hub registration, which allows remote hubs to obtain sensitive site information by reading form data.
Patch / fix
- packagist moodle/moodle 2.2.10, 2.3.7, 2.4.4
- github.com/moodle/moodle@1d79b72 commit
- github.com/moodle/moodle@1fc34e3 commit
- github.com/moodle/moodle@4d65904 commit
- github.com/moodle/moodle@54a3ce6 commit
- github.com/moodle/moodle@60c468b commit
- github.com/moodle/moodle@667eaec commit
- github.com/moodle/moodle@669dee5 commit
- github.com/moodle/moodle@a811e8a commit
- github.com/moodle/moodle@be6281e commit
- github.com/moodle/moodle@fd46903 commit
Is CVE-2013-2081 in your dependencies? Fencer shows which of your repositories are affected as soon as an advisory lands, and opens the fix as a pull request.
Check with FencerVendor advisories
What the vendors themselves say about their products: affected, fixed or not affected, and what to do.
red hat product security vex CVE-2013-2081 updated cvss 4.3
moodle: upstream 2.4.4, 2.3.7, and 2.2.10 fixes
-
Red Hat All currently supported Red Hat productsnot affected: vulnerable code not present
Red Hat CSAF VEX © Red Hat, Inc., from https://security.access.redhat.com/data/csaf/v2/vex/; changed: reduced to product statuses and remediations. CC BY 4.0 · csaf
Exploit prediction
1.55% chance of exploitation in the next 30 days, higher than 75% of all scored CVEs (FIRST EPSS, 2026-11-09).
CVSS scores
| assigned by | version | score | vector |
|---|---|---|---|
| NVD | 2.0 | 4.3 | AV:N/AC:M/Au:N/C:P/I:N/A:N |
Affected packages
| ecosystem | package | affected | fixed in |
|---|---|---|---|
| packagist | moodle/moodle | <2.2.10 >=2.3.0, <2.3.7 >=2.4.0, <2.4.4 |
2.2.10 2.3.7 2.4.4 |
Classification
References
-
git.moodle.org
/gw?p=moodle.git&a=search&h=HEAD&st=commit&s=MDL-37822
web, patch
-
github.com
/moodle/moodle/commit/1d79b726d762bcc629c1a2a74cfa3eca5a7c5da7
web
-
github.com
/moodle/moodle/commit/1fc34e37fdc57b4ec303cb942dc5d5535b953ed7
web
-
github.com
/moodle/moodle/commit/4d65904bc132548a2ef4c2a40bf5ba2cffb5f68f
web
-
github.com
/moodle/moodle/commit/54a3ce69e9ca751fffd0b3e0eb5be4add50de113
web
-
github.com
/moodle/moodle/commit/60c468bcb3b6f867a70f2f30427b52e0362e93d1
web
-
github.com
/moodle/moodle/commit/667eaec4d2679a8bc1fcd9f0ff17a1be2babccb0
web
-
github.com
/moodle/moodle/commit/669dee58048b18d9034a7b2367b97a50b498b0e0
web
-
github.com
/moodle/moodle/commit/a811e8ac56e49a174b68ceade81197c80be4b325
web
-
github.com
/moodle/moodle/commit/be6281e2cbc2fb40b96a48c07c80883fa80cd1b7
web
-
github.com
/moodle/moodle/commit/fd469033fa2c860647e48f3d543346503a37faa0
web
-
lists.fedoraproject.org
/pipermail/package-announce/2013-May/106965.html
vendor-advisory, web
-
lists.fedoraproject.org
/pipermail/package-announce/2013-May/107026.html
vendor-advisory, web
-
lists.fedoraproject.org
/pipermail/package-announce/2013-May/106988.html
vendor-advisory, web
-
moodle.org
/mod/forum/discuss.php?d=228933
web, vendor-advisory
-
openwall.com
/lists/oss-security/2013/05/21/1
mailing-list, web
-
nvd.nist.gov
/vuln/detail/CVE-2013-2081
advisory
-
github.com
/moodle/moodle
package
Sources
- CVE List CVE-2013-2081
- GitHub Advisory GHSA-x3x8-fjw6-hccx
- NVD CVE-2013-2081
Fencer Intel keeps one entry per vulnerability: the CVE id wins, then GHSA, and records that alias each other are merged, except that two CVEs always keep separate entries. The same data is available as JSON.