CVE-2013-2081

Moodle does not consider "don't send" attributes during hub registration

4.3 MediumFix available

Moodle through 2.1.10, 2.2.x before 2.2.10, 2.3.x before 2.3.7, and 2.4.x before 2.4.4 does not consider "don't send" attributes during hub registration, which allows remote hubs to obtain sensitive site information by reading form data.

Exploit likelihood

1.55%Up 0.4 points since Feb 4, 2022

What each source reports

NVD Score used 4.3

Record: CVE-2013-2081
CVSS 2.0: 4.3 MediumAV:N/AC:M/Au:N/C:P/I:N/A:N
Weakness: CWE-264
Updated: 2026-11-02

CVE List No score

Record: CVE-2013-2081
Updated: 2026-11-02

EUVDEUVD-2022-5705 No score

Record: EUVD-2022-5705
Updated: 2026-11-03

GitHub AdvisoriesGHSA-x3x8-fjw6-hccx No score

Moodle does not consider "don't send" attributes during hub registration

Record: GHSA-x3x8-fjw6-hccx
Weakness: CWE-284
Updated: 2026-11-02

OSVGHSA-x3x8-fjw6-hccx No score

Moodle does not consider "don't send" attributes during hub registration

Record: GHSA-x3x8-fjw6-hccx
Weakness: CWE-284
Updated: 2026-11-02

OSVMGASA-2013-0162 No score

Updated moodle package fix security vulnerabilities

The assignment module in Moodle before 2.4.4 was not checking capabilities for users downloading all assignments as a zip (CVE-2013-2079).

The Gradebook's Overview report in Moodle before 2.4.4 was showing grade totals that may have incorrectly included hidden grades (CVE-2013-2080).

When registering a site on a hub (not Moodle.net) site in Moodle before 2.4.4, information was being sent to the hub regardless of settings chosen (CVE-2013-2081).

There was no check of permissions for viewing comments on blog posts in Moodle before 2.4.4 (CVE-2013-2082).

Form elements named using a specific naming scheme were not being filtered correctly in Moodle before 2.4.4 (CVE-2013-2083).

Record: MGASA-2013-0162
Updated: 2026-11-02

OSVUBUNTU-CVE-2013-2081 No score

Record: UBUNTU-CVE-2013-2081
Updated: 2026-11-02

Affected products

moodle

Affected packages

Affected packages
Package	Affected	Fixed
`moodle/moodle` Packagist	before 2.2.10	2.2.10
`moodle/moodle` Packagist	2.3.0 up to 2.3.7	2.3.7
`moodle/moodle` Packagist	2.4.0 up to 2.4.4	2.4.4
`moodle/moodle` Packagist	2.3.0 up to 2.3.7, plus listed versions v2.3.4v2.3.5v2.3.6	2.3.7
`moodle/moodle` Packagist	2.4.0 up to 2.4.4, plus listed versions v2.4.0v2.4.1v2.4.2v2.4.3	2.4.4
`moodle` Mageia:3 From an advisory covering 5 CVEs	before 2.4.4-1.1.mga3	2.4.4-1.1.mga3
`moodle` Ubuntu:Pro:16.04:LTS	All versions, plus listed versions 2.7.9+dfsg-12.7.10+dfsg-12.7.11+dfsg-12.7.11+dfsg-22.7.12+dfsg-13.0.3+dfsg-0ubuntu13.0.3+dfsg-0ubuntu1+esm1	None known
`moodle` Ubuntu:Pro:18.04:LTS	All versions, plus listed versions 3.0.3+dfsg-0ubuntu13.0.3+dfsg-0ubuntu1+esm1	None known

History

History
Recorded	Changed	Sources
Nov 6, 2026	affected, facts
Nov 3, 2026	aliases	EUVD
Nov 2, 2026	first indexed	CVE List, GitHub Advisories, NVD, OSV

Dates are when Every CVE recorded each change. Upstream dates may differ.

In short

CVE-2013-2081 is a medium vulnerability (CVSS 4.3) in Moodle, published May 25, 2013. No source lists public exploit code. EPSS puts the chance of exploitation in the next 30 days at 1.55%, the 75th percentile. Fixed in moodle/moodle 2.2.10.

References

Show 22 moreShow less