CVE-2013-2080
Moodle is vulnerable to Sensitive Information Disclosure
The core_grade component in Moodle through 2.2.10, 2.3.x before 2.3.7, and 2.4.x before 2.4.4 does not properly consider the existence of hidden grades, which allows remote authenticated users to obtain sensitive information by leveraging the student role and reading the Gradebook Overview report.
Exploit likelihood
What each source reports
NVD Score used
The core_grade component in Moodle through 2.2.10, 2.3.x before 2.3.7, and 2.4.x before 2.4.4 does not properly consider the existence of hidden grades, which allows remote authenticated users to obtain sensitive information by leveraging the student role and reading the Gradebook Overview report.
- Record
CVE-2013-2080- CVSS 2.0
- 4.0 Medium
AV:N/AC:L/Au:S/C:P/I:N/A:N - Weakness
- CWE-264
- Updated
- 2026-11-02
CVE List No score
The core_grade component in Moodle through 2.2.10, 2.3.x before 2.3.7, and 2.4.x before 2.4.4 does not properly consider the existence of hidden grades, which allows remote authenticated users to obtain sensitive information by leveraging the student role and reading the Gradebook Overview report.
- Record
CVE-2013-2080- Updated
- 2026-11-02
EUVDEUVD-2022-5600 No score
The core_grade component in Moodle through 2.2.10, 2.3.x before 2.3.7, and 2.4.x before 2.4.4 does not properly consider the existence of hidden grades, which allows remote authenticated users to obtain sensitive information by leveraging the student role and reading the Gradebook Overview report.
- Record
EUVD-2022-5600- Updated
- 2026-11-03
GitHub AdvisoriesGHSA-wmmc-qjq2-vvm2 No score
Moodle is vulnerable to Sensitive Information Disclosure
The core_grade component in Moodle through 2.2.10, 2.3.x before 2.3.7, and 2.4.x before 2.4.4 does not properly consider the existence of hidden grades, which allows remote authenticated users to obtain sensitive information by leveraging the student role and reading the Gradebook Overview report.
- Record
GHSA-wmmc-qjq2-vvm2- Weakness
- CWE-200
- Updated
- 2026-11-02
OSVGHSA-wmmc-qjq2-vvm2 No score
Moodle is vulnerable to Sensitive Information Disclosure
The core_grade component in Moodle through 2.2.10, 2.3.x before 2.3.7, and 2.4.x before 2.4.4 does not properly consider the existence of hidden grades, which allows remote authenticated users to obtain sensitive information by leveraging the student role and reading the Gradebook Overview report.
- Record
GHSA-wmmc-qjq2-vvm2- Weakness
- CWE-200
- Updated
- 2026-11-02
OSVMGASA-2013-0162 No score
Updated moodle package fix security vulnerabilities
The assignment module in Moodle before 2.4.4 was not checking capabilities for users downloading all assignments as a zip (CVE-2013-2079).
The Gradebook's Overview report in Moodle before 2.4.4 was showing grade totals that may have incorrectly included hidden grades (CVE-2013-2080).
When registering a site on a hub (not Moodle.net) site in Moodle before 2.4.4, information was being sent to the hub regardless of settings chosen (CVE-2013-2081).
There was no check of permissions for viewing comments on blog posts in Moodle before 2.4.4 (CVE-2013-2082).
Form elements named using a specific naming scheme were not being filtered correctly in Moodle before 2.4.4 (CVE-2013-2083).
- Record
MGASA-2013-0162- Updated
- 2026-11-02
OSVUBUNTU-CVE-2013-2080 No score
The core_grade component in Moodle through 2.2.10, 2.3.x before 2.3.7, and 2.4.x before 2.4.4 does not properly consider the existence of hidden grades, which allows remote authenticated users to obtain sensitive information by leveraging the student role and reading the Gradebook Overview report.
- Record
UBUNTU-CVE-2013-2080- Updated
- 2026-11-02
Affected products
Affected packages
| Package | Affected | Fixed |
|---|---|---|
moodle/moodlePackagist |
2.4.0 up to 2.4.4 | 2.4.4 |
moodle/moodlePackagist |
before 2.3.7 | 2.3.7 |
moodle/moodlePackagist |
before 2.3.7, plus listed versions v2.3.4v2.3.5v2.3.6 |
2.3.7 |
moodle/moodlePackagist |
2.4.0 up to 2.4.4, plus listed versions v2.4.0v2.4.1v2.4.2v2.4.3 |
2.4.4 |
moodleMageia:3 From an advisory covering 5 CVEs |
before 2.4.4-1.1.mga3 | 2.4.4-1.1.mga3 |
moodleUbuntu:Pro:16.04:LTS |
All versions, plus listed versions 2.7.9+dfsg-12.7.10+dfsg-12.7.11+dfsg-12.7.11+dfsg-22.7.12+dfsg-13.0.3+dfsg-0ubuntu13.0.3+dfsg-0ubuntu1+esm1 |
None known |
moodleUbuntu:Pro:18.04:LTS |
All versions, plus listed versions 3.0.3+dfsg-0ubuntu13.0.3+dfsg-0ubuntu1+esm1 |
None known |
History
| Recorded | Changed | Sources |
|---|---|---|
| affected, facts | ||
| aliases | EUVD | |
| first indexed | CVE List, GitHub Advisories, NVD, OSV |
Dates are when Every CVE recorded each change. Upstream dates may differ.
In short
CVE-2013-2080 is a medium vulnerability (CVSS 4.0) in Moodle, published May 25, 2013. No source lists public exploit code. EPSS puts the chance of exploitation in the next 30 days at 1.82%, the 78th percentile. Fixed in moodle/moodle 2.4.4.
References
git.moodle.org/gw?p=moodle.git&a=search&h=HEAD&st=commit&s=MDL-37475
lists.fedoraproject.org/pipermail/package-announce/2013-May/106965.html
openwall.com/lists/oss-security/2013/05/21/1
moodle.org/mod/forum/discuss.php?d=228931
Show 15 moreShow less
nvd.nist.gov/vuln/detail/CVE-2013-2080
github.com/moodle/moodle/commit/4b280ca67972479b4b86dd8861bcbeb8c06e41f9
advisories.mageia.org/MGASA-2013-0162.html
docs.moodle.org/dev/Moodle_2.4.4_release_notes
ubuntu.com/security/CVE-2013-2080
cve.org/CVERecord?id=CVE-2013-2080