CVE-2013-2081
Moodle does not consider "don't send" attributes during hub registration
CVE-2013-2081 is a medium vulnerability (CVSS 4.3) in Moodle, published May 25, 2013. No source lists public exploit code. EPSS puts the chance of exploitation in the next 30 days at 1.55%, the 75th percentile. Fixed in moodle/moodle 2.2.10.
- Severity
- 4.3 MediumCVSS 2.0, NVD
- Exploit chance
- 1.55%EPSS, 75th percentile
- Exploitation
- None knownNot on CISA’s or ENISA’s lists
- Fixed in
2.2.10moodle/moodle +7 more
Description
Moodle through 2.1.10, 2.2.x before 2.2.10, 2.3.x before 2.3.7, and 2.4.x before 2.4.4 does not consider "don't send" attributes during hub registration, which allows remote hubs to obtain sensitive site information by reading form data.
Exploit likelihood
Affected products
Affected packages
| Package | Affected | Fixed |
|---|---|---|
moodle/moodlePackagist | before 2.2.10 | 2.2.10 |
moodle/moodlePackagist | 2.3.0 up to 2.3.7 | 2.3.7 |
moodle/moodlePackagist | 2.4.0 up to 2.4.4 | 2.4.4 |
moodle/moodlePackagist | 2.3.0 up to 2.3.7, plus listed versions v2.3.4v2.3.5v2.3.6 | 2.3.7 |
moodle/moodlePackagist | 2.4.0 up to 2.4.4, plus listed versions v2.4.0v2.4.1v2.4.2v2.4.3 | 2.4.4 |
moodleMageia:3 From an advisory covering 5 CVEs | before 2.4.4-1.1.mga3 | 2.4.4-1.1.mga3 |
moodleUbuntu:Pro:16.04:LTS | All versions, plus listed versions 2.7.9+dfsg-12.7.10+dfsg-12.7.11+dfsg-12.7.11+dfsg-22.7.12+dfsg-13.0.3+dfsg-0ubuntu13.0.3+dfsg-0ubuntu1+esm1 | None known |
moodleUbuntu:Pro:18.04:LTS | All versions, plus listed versions 3.0.3+dfsg-0ubuntu13.0.3+dfsg-0ubuntu1+esm1 | None known |
What each source reports
NVD Score used
Moodle through 2.1.10, 2.2.x before 2.2.10, 2.3.x before 2.3.7, and 2.4.x before 2.4.4 does not consider "don't send" attributes during hub registration, which allows remote hubs to obtain sensitive site information by reading form data.
- Record
CVE-2013-2081- CVSS 2.0
- 4.3 Medium
AV:N/AC:M/Au:N/C:P/I:N/A:N - Weakness
- CWE-264
- Updated
- 2026-11-02
CVE ListNo score
Moodle through 2.1.10, 2.2.x before 2.2.10, 2.3.x before 2.3.7, and 2.4.x before 2.4.4 does not consider "don't send" attributes during hub registration, which allows remote hubs to obtain sensitive site information by reading form data.
- Record
CVE-2013-2081- Updated
- 2026-11-02
EUVDEUVD-2022-5705No score
Moodle through 2.1.10, 2.2.x before 2.2.10, 2.3.x before 2.3.7, and 2.4.x before 2.4.4 does not consider "don't send" attributes during hub registration, which allows remote hubs to obtain sensitive site information by reading form data.
- Record
EUVD-2022-5705- Updated
- 2026-11-03
GitHub AdvisoriesGHSA-x3x8-fjw6-hccxNo score
Moodle does not consider "don't send" attributes during hub registration
Moodle through 2.1.10, 2.2.x before 2.2.10, 2.3.x before 2.3.7, and 2.4.x before 2.4.4 does not consider "don't send" attributes during hub registration, which allows remote hubs to obtain sensitive site information by reading form data.
- Record
GHSA-x3x8-fjw6-hccx- Weakness
- CWE-284
- Updated
- 2026-11-02
OSVGHSA-x3x8-fjw6-hccxNo score
Moodle does not consider "don't send" attributes during hub registration
Moodle through 2.1.10, 2.2.x before 2.2.10, 2.3.x before 2.3.7, and 2.4.x before 2.4.4 does not consider "don't send" attributes during hub registration, which allows remote hubs to obtain sensitive site information by reading form data.
- Record
GHSA-x3x8-fjw6-hccx- Weakness
- CWE-284
- Updated
- 2026-11-02
OSVMGASA-2013-0162No score
Updated moodle package fix security vulnerabilities
The assignment module in Moodle before 2.4.4 was not checking capabilities for users downloading all assignments as a zip (CVE-2013-2079).
The Gradebook's Overview report in Moodle before 2.4.4 was showing grade totals that may have incorrectly included hidden grades (CVE-2013-2080).
When registering a site on a hub (not Moodle.net) site in Moodle before 2.4.4, information was being sent to the hub regardless of settings chosen (CVE-2013-2081).
There was no check of permissions for viewing comments on blog posts in Moodle before 2.4.4 (CVE-2013-2082).
Form elements named using a specific naming scheme were not being filtered correctly in Moodle before 2.4.4 (CVE-2013-2083).
- Record
MGASA-2013-0162- Updated
- 2026-11-02
OSVUBUNTU-CVE-2013-2081No score
Moodle through 2.1.10, 2.2.x before 2.2.10, 2.3.x before 2.3.7, and 2.4.x before 2.4.4 does not consider "don't send" attributes during hub registration, which allows remote hubs to obtain sensitive site information by reading form data.
- Record
UBUNTU-CVE-2013-2081- Updated
- 2026-11-02
History
| Recorded | Changed | Sources |
|---|---|---|
| affected, facts | ||
| aliases | EUVD | |
| first indexed | CVE List, GitHub Advisories, NVD, OSV |
Dates are when Every CVE recorded each change. Upstream dates may differ.
References
git.moodle.org/gw?p=moodle.git&a=search&h=HEAD&st=commit&s=MDL-37822
moodle.org/mod/forum/discuss.php?d=228933
lists.fedoraproject.org/pipermail/package-announce/2013-May/106965.html
openwall.com/lists/oss-security/2013/05/21/1
Show 22 moreShow less
nvd.nist.gov/vuln/detail/CVE-2013-2081
github.com/moodle/moodle/commit/1d79b726d762bcc629c1a2a74cfa3eca5a7c5da7
advisories.mageia.org/MGASA-2013-0162.html
docs.moodle.org/dev/Moodle_2.4.4_release_notes
ubuntu.com/security/CVE-2013-2081
cve.org/CVERecord?id=CVE-2013-2081