CVE-2013-2082

Moodle does not enforce capability requirements for reading blog comments

5.0 MediumFix available

Moodle through 2.1.10, 2.2.x before 2.2.10, 2.3.x before 2.3.7, and 2.4.x before 2.4.4 does not enforce capability requirements for reading blog comments, which allows remote attackers to obtain sensitive information via a crafted request.

Exploit likelihood

2.31%Up 1.0 points since Feb 4, 2022

What each source reports

NVD Score used 5.0

Record: CVE-2013-2082
CVSS 2.0: 5.0 MediumAV:N/AC:L/Au:N/C:P/I:N/A:N
Weakness: CWE-264
Updated: 2026-11-02

CVE List No score

Record: CVE-2013-2082
Updated: 2026-11-02

EUVDEUVD-2022-5609 No score

Record: EUVD-2022-5609
Updated: 2026-11-03

GitHub AdvisoriesGHSA-wp3g-pr4h-q6vv No score

Moodle does not enforce capability requirements for reading blog comments

Record: GHSA-wp3g-pr4h-q6vv
Updated: 2026-11-02

OSVGHSA-wp3g-pr4h-q6vv No score

Moodle does not enforce capability requirements for reading blog comments

Record: GHSA-wp3g-pr4h-q6vv
Updated: 2026-11-02

OSVMGASA-2013-0162 No score

Updated moodle package fix security vulnerabilities

The assignment module in Moodle before 2.4.4 was not checking capabilities for users downloading all assignments as a zip (CVE-2013-2079).

The Gradebook's Overview report in Moodle before 2.4.4 was showing grade totals that may have incorrectly included hidden grades (CVE-2013-2080).

When registering a site on a hub (not Moodle.net) site in Moodle before 2.4.4, information was being sent to the hub regardless of settings chosen (CVE-2013-2081).

There was no check of permissions for viewing comments on blog posts in Moodle before 2.4.4 (CVE-2013-2082).

Form elements named using a specific naming scheme were not being filtered correctly in Moodle before 2.4.4 (CVE-2013-2083).

Record: MGASA-2013-0162
Updated: 2026-11-02

OSVUBUNTU-CVE-2013-2082 No score

Record: UBUNTU-CVE-2013-2082
Updated: 2026-11-02

Affected products

moodle

Affected packages

Affected packages
Package	Affected	Fixed
`moodle/moodle` Packagist	before 2.2.10	2.2.10
`moodle/moodle` Packagist	2.3.0 up to 2.3.7	2.3.7
`moodle/moodle` Packagist	2.4.0 up to 2.4.4	2.4.4
`moodle/moodle` Packagist	2.3.0 up to 2.3.7, plus listed versions v2.3.4v2.3.5v2.3.6	2.3.7
`moodle/moodle` Packagist	2.4.0 up to 2.4.4, plus listed versions v2.4.0v2.4.1v2.4.2v2.4.3	2.4.4
`moodle` Mageia:3 From an advisory covering 5 CVEs	before 2.4.4-1.1.mga3	2.4.4-1.1.mga3
`moodle` Ubuntu:Pro:16.04:LTS	All versions, plus listed versions 2.7.9+dfsg-12.7.10+dfsg-12.7.11+dfsg-12.7.11+dfsg-22.7.12+dfsg-13.0.3+dfsg-0ubuntu13.0.3+dfsg-0ubuntu1+esm1	None known
`moodle` Ubuntu:Pro:18.04:LTS	All versions, plus listed versions 3.0.3+dfsg-0ubuntu13.0.3+dfsg-0ubuntu1+esm1	None known

History

History
Recorded	Changed	Sources
Nov 6, 2026	affected, facts
Nov 3, 2026	aliases	EUVD
Nov 2, 2026	first indexed	CVE List, GitHub Advisories, NVD, OSV

Dates are when Every CVE recorded each change. Upstream dates may differ.

In short

CVE-2013-2082 is a medium vulnerability (CVSS 5.0) in Moodle, published May 25, 2013. No source lists public exploit code. EPSS puts the chance of exploitation in the next 30 days at 2.31%, the 83rd percentile. Fixed in moodle/moodle 2.2.10.

References

Show 18 moreShow less