CVE-2013-1833
Moodle Multiple cross-site scripting (XSS) vulnerabilities in the File Picker module
Multiple cross-site scripting (XSS) vulnerabilities in the File Picker module in Moodle 2.x through 2.1.10, 2.2.x before 2.2.8, 2.3.x before 2.3.5, and 2.4.x before 2.4.2 allow remote authenticated users to inject arbitrary web script or HTML via a crafted filename.
Exploit likelihood
What each source reports
NVD Score used
Multiple cross-site scripting (XSS) vulnerabilities in the File Picker module in Moodle 2.x through 2.1.10, 2.2.x before 2.2.8, 2.3.x before 2.3.5, and 2.4.x before 2.4.2 allow remote authenticated users to inject arbitrary web script or HTML via a crafted filename.
- Record
CVE-2013-1833- CVSS 2.0
- 3.5 Low
AV:N/AC:M/Au:S/C:N/I:P/A:N - Weakness
- CWE-79
- Updated
- 2026-11-02
CVE List No score
Multiple cross-site scripting (XSS) vulnerabilities in the File Picker module in Moodle 2.x through 2.1.10, 2.2.x before 2.2.8, 2.3.x before 2.3.5, and 2.4.x before 2.4.2 allow remote authenticated users to inject arbitrary web script or HTML via a crafted filename.
- Record
CVE-2013-1833- Updated
- 2026-11-02
EUVDEUVD-2022-3156 No score
Multiple cross-site scripting (XSS) vulnerabilities in the File Picker module in Moodle 2.x through 2.1.10, 2.2.x before 2.2.8, 2.3.x before 2.3.5, and 2.4.x before 2.4.2 allow remote authenticated users to inject arbitrary web script or HTML via a crafted filename.
- Record
EUVD-2022-3156- Updated
- 2026-11-03
GitHub AdvisoriesGHSA-89f3-74m6-g27g No score
Moodle Multiple cross-site scripting (XSS) vulnerabilities in the File Picker module
Multiple cross-site scripting (XSS) vulnerabilities in the File Picker module in Moodle 2.x through 2.1.10, 2.2.x before 2.2.8, 2.3.x before 2.3.5, and 2.4.x before 2.4.2 allow remote authenticated users to inject arbitrary web script or HTML via a crafted filename.
- Record
GHSA-89f3-74m6-g27g- Weakness
- CWE-79
- Updated
- 2026-11-02
OSVGHSA-89f3-74m6-g27g No score
Moodle Multiple cross-site scripting (XSS) vulnerabilities in the File Picker module
Multiple cross-site scripting (XSS) vulnerabilities in the File Picker module in Moodle 2.x through 2.1.10, 2.2.x before 2.2.8, 2.3.x before 2.3.5, and 2.4.x before 2.4.2 allow remote authenticated users to inject arbitrary web script or HTML via a crafted filename.
- Record
GHSA-89f3-74m6-g27g- Weakness
- CWE-79
- Updated
- 2026-11-02
OSVUBUNTU-CVE-2013-1833 No score
Multiple cross-site scripting (XSS) vulnerabilities in the File Picker module in Moodle 2.x through 2.1.10, 2.2.x before 2.2.8, 2.3.x before 2.3.5, and 2.4.x before 2.4.2 allow remote authenticated users to inject arbitrary web script or HTML via a crafted filename.
- Record
UBUNTU-CVE-2013-1833- Updated
- 2026-11-02
Affected products
Affected packages
| Package | Affected | Fixed |
|---|---|---|
moodle/moodlePackagist |
2.2.0 up to 2.2.8 | 2.2.8 |
moodle/moodlePackagist |
2.3.0 up to 2.3.5 | 2.3.5 |
moodle/moodlePackagist |
2.4.0 up to 2.4.2 | 2.4.2 |
moodle/moodlePackagist |
2.0.0 to 2.1.10 | None known |
moodle/moodlePackagist |
2.3.0 up to 2.3.5, plus listed versions v2.3.4 |
2.3.5 |
moodle/moodlePackagist |
2.4.0 up to 2.4.2, plus listed versions v2.4.0v2.4.1 |
2.4.2 |
moodleUbuntu:Pro:16.04:LTS |
All versions, plus listed versions 2.7.9+dfsg-12.7.10+dfsg-12.7.11+dfsg-12.7.11+dfsg-22.7.12+dfsg-13.0.3+dfsg-0ubuntu13.0.3+dfsg-0ubuntu1+esm1 |
None known |
moodleUbuntu:Pro:18.04:LTS |
All versions, plus listed versions 3.0.3+dfsg-0ubuntu13.0.3+dfsg-0ubuntu1+esm1 |
None known |
History
| Recorded | Changed | Sources |
|---|---|---|
| aliases | EUVD | |
| first indexed | CVE List, GitHub Advisories, NVD, OSV |
Dates are when Every CVE recorded each change. Upstream dates may differ.
In short
CVE-2013-1833 is a low vulnerability (CVSS 3.5) in Moodle, published March 11, 2013. No source lists public exploit code. EPSS puts the chance of exploitation in the next 30 days at 1.45%, the 73rd percentile. Fixed in moodle/moodle 2.2.8.
References
lists.fedoraproject.org/pipermail/package-announce/2013-April/101358.html
moodle.org/mod/forum/discuss.php?d=225344
git.moodle.org/gw?p=moodle.git&a=search&h=HEAD&st=commit&s=MDL-37507
openwall.com/lists/oss-security/2013/03/25/2
nvd.nist.gov/vuln/detail/CVE-2013-1833
Show 8 moreShow less
github.com/moodle/moodle/commit/75822af579ec07cca1c6781a7c989625dcdd5463
ubuntu.com/security/CVE-2013-1833
cve.org/CVERecord?id=CVE-2013-1833