PT-2013-5058 · Moodle · Moodle

Tony Levi · Published 2013-11-26 · Updated 2022-05-13 · CVE-2013-4522

Positive Technologies (AI Summary)

CVSS v4.0

6.9

Medium

Base vector

AV:N/AC:L/AT:N/PR:N/UI:N/VC:L/VI:N/VA:N/SC:N/SI:N/SA:N

Name of the Vulnerable Software and Affected Versions Moodle versions 2.2.11 and earlier, 2.3.x before 2.3.10, 2.4.x before 2.4.7, 2.5.x before 2.5.3

Description The issue allows remote attackers to obtain sensitive information by requesting a file that had been previously retrieved by a caching proxy server, due to the lack of "Cache-Control: private" HTTP headers.

Recommendations For versions 2.2.11 and earlier, update to version 2.2.12 or later. For versions 2.3.x before 2.3.10, update to version 2.3.10 or later. For versions 2.4.x before 2.4.7, update to version 2.4.7 or later. For versions 2.5.x before 2.5.3, update to version 2.5.3 or later.

Exploit

Fix

Information Disclosure

Weakness Enumeration

CWE-200

Related Identifiers

CVE-2013-4522

GHSA-VM9C-39JX-Q45W

MGASA-2013-0356

Affected Products

Moodle

References · 18

• 🔥 http://git.moodle.org/gw?p=moodle.git&a=search&h=HEAD&st=commit&s=MDL-38743 · Exploit
• https://osv.dev/vulnerability/MGASA-2013-0356 · Vendor Advisory
• https://ubuntu.com/security/CVE-2013-4522 · Vendor Advisory
• https://osv.dev/vulnerability/UBUNTU-CVE-2013-4522 · Vendor Advisory
• https://moodle.org/mod/forum/discuss.php?d=244479 · Vendor Advisory
• https://cve.org/CVERecord?id=CVE-2013-4522 · Security Note
• https://nvd.nist.gov/vuln/detail/CVE-2013-4522 · Security Note
• https://advisories.mageia.org/MGASA-2013-0356.html · Security Note
• https://osv.dev/vulnerability/GHSA-vm9c-39jx-q45w · Vendor Advisory
• https://github.com/moodle/moodle · Note
• https://github.com/moodle/moodle/commit/d0041fb110201d3dc1a4546eca8b6108b440d1c5 · Note
• https://moodle.org/mod/forum/discuss.php?d=244481 · Note
• http://docs.moodle.org/dev/Moodle_2.4.7_release_notes · Note
• https://moodle.org/mod/forum/discuss.php?d=244480 · Note
• https://bugs.mageia.org/show_bug.cgi?id=11671 · Note