CVE-2013-2242
mod/chat/gui_sockets/index.php in Moodle through 2.1.10, 2.2.x before 2.2.11, 2.3.x before 2.3.8,...
mod/chat/gui_sockets/index.php in Moodle through 2.1.10, 2.2.x before 2.2.11, 2.3.x before 2.3.8, 2.4.x before 2.4.5, and 2.5.x before 2.5.1 does not consider the mod/chat:chat capability before authorizing daemon-mode chat, which allows remote authenticated users to bypass intended access restrictions via an HTTP session to a chat server.
Exploit likelihood
What each source reports
NVD Score used
mod/chat/gui_sockets/index.php in Moodle through 2.1.10, 2.2.x before 2.2.11, 2.3.x before 2.3.8, 2.4.x before 2.4.5, and 2.5.x before 2.5.1 does not consider the mod/chat:chat capability before authorizing daemon-mode chat, which allows remote authenticated users to bypass intended access restrictions via an HTTP session to a chat server.
- Record
CVE-2013-2242- CVSS 2.0
- 4.0 Medium
AV:N/AC:L/Au:S/C:P/I:N/A:N - Weakness
- CWE-264
- Updated
- 2026-11-02
CVE List No score
mod/chat/gui_sockets/index.php in Moodle through 2.1.10, 2.2.x before 2.2.11, 2.3.x before 2.3.8, 2.4.x before 2.4.5, and 2.5.x before 2.5.1 does not consider the mod/chat:chat capability before authorizing daemon-mode chat, which allows remote authenticated users to bypass intended access restrictions via an HTTP session to a chat server.
- Record
CVE-2013-2242- Updated
- 2026-11-02
EUVDEUVD-2013-2193 No score
mod/chat/gui_sockets/index.php in Moodle through 2.1.10, 2.2.x before 2.2.11, 2.3.x before 2.3.8, 2.4.x before 2.4.5, and 2.5.x before 2.5.1 does not consider the mod/chat:chat capability before authorizing daemon-mode chat, which allows remote authenticated users to bypass intended access restrictions via an HTTP session to a chat server.
- Record
EUVD-2013-2193- Updated
- 2026-11-03
GitHub AdvisoriesGHSA-pg89-qp74-vch2 No score
mod/chat/gui_sockets/index.php in Moodle through 2.1.10, 2.2.x before 2.2.11, 2.3.x before 2.3.8,...
mod/chat/gui_sockets/index.php in Moodle through 2.1.10, 2.2.x before 2.2.11, 2.3.x before 2.3.8, 2.4.x before 2.4.5, and 2.5.x before 2.5.1 does not consider the mod/chat:chat capability before authorizing daemon-mode chat, which allows remote authenticated users to bypass intended access restrictions via an HTTP session to a chat server.
- Record
GHSA-pg89-qp74-vch2- Updated
- 2026-11-02
OSVMGASA-2013-0217 No score
Updated moodle package fixes multiple security vulnerabilities
Flash files distributed with the YUI library in Moodle before 2.4.5 may have allowed for cross-site scripting attacks (MSA-13-0025).
Privacy settings for the IMS-LTI (External tool) module in Moodle before 2.4.5 were not able to be changed so personal information was always transferred (MSA-13-0026).
Users were able to access a daemon-mode Chat activity in Moodle before 2.4.5 without the required capability (CVE-2013-2242).
It was possible to determine answers from ID values in Lesson activity matching questions in Moodle before 2.4.5 (CVE-2013-2243).
Conditional access rule values for user fields were able to contain unescaped HTML/JS that would be output to users in Moodle before 2.4.5 (CVE-2013-2244).
When impersonating another user using RSS tokens in Moodle before 2.4.5, an error was displayed, but block information relevant to the person being impersonated was shown (CVE-2013-2245).
The Feedback module in Moodle before 2.4.5 was showing personal information to users without the needed capability (CVE-2013-2246).
- Record
MGASA-2013-0217- Updated
- 2026-11-02
Affected products
Affected packages
| Package | Affected | Fixed |
|---|---|---|
moodleMageia:3 From an advisory covering 5 CVEs |
before 2.4.5-1.mga3 | 2.4.5-1.mga3 |
History
| Recorded | Changed | Sources |
|---|---|---|
| affected, facts | ||
| aliases | EUVD | |
| first indexed | CVE List, GitHub Advisories, NVD, OSV |
Dates are when Every CVE recorded each change. Upstream dates may differ.
In short
CVE-2013-2242 is a medium vulnerability (CVSS 4.0) in Moodle, published July 21, 2013. No source lists public exploit code. EPSS puts the chance of exploitation in the next 30 days at 1.00%, the 63rd percentile. No source names a fixed version.
References
git.moodle.org/gw?p=moodle.git&a=search&h=HEAD&st=commit&s=MDL-39628
moodle.org/mod/forum/discuss.php?d=232498
nvd.nist.gov/vuln/detail/CVE-2013-2242
github.com/advisories/GHSA-pg89-qp74-vch2
advisories.mageia.org/MGASA-2013-0217.html
Show 8 moreShow less
docs.moodle.org/dev/Moodle_2.4.5_release_notes
bugs.mageia.org/show_bug.cgi?id=10755