CVE-2013-2079

mod/assign/locallib.php in the assignment module in Moodle 2.3.x before 2.3.7 and 2.4.x before 2...

4.0 Medium

mod/assign/locallib.php in the assignment module in Moodle 2.3.x before 2.3.7 and 2.4.x before 2.4.4 does not consider capability requirements during the processing of ZIP assignment-archive download (aka downloadall) requests, which allows remote authenticated users to read other users' assignments by leveraging the student role.

Exploit likelihood

1.23%Unchanged since Feb 4, 2022

What each source reports

NVD Score used 4.0

Record: CVE-2013-2079
CVSS 2.0: 4.0 MediumAV:N/AC:L/Au:S/C:P/I:N/A:N
Weakness: CWE-264
Updated: 2026-11-02

CVE List No score

Record: CVE-2013-2079
Updated: 2026-11-02

EUVDEUVD-2013-2058 No score

Record: EUVD-2013-2058
Updated: 2026-11-03

GitHub AdvisoriesGHSA-x6xq-cgc6-h2fq No score

mod/assign/locallib.php in the assignment module in Moodle 2.3.x before 2.3.7 and 2.4.x before 2...

Record: GHSA-x6xq-cgc6-h2fq
Updated: 2026-11-02

OSVMGASA-2013-0162 No score

Updated moodle package fix security vulnerabilities

The assignment module in Moodle before 2.4.4 was not checking capabilities for users downloading all assignments as a zip (CVE-2013-2079).

The Gradebook's Overview report in Moodle before 2.4.4 was showing grade totals that may have incorrectly included hidden grades (CVE-2013-2080).

When registering a site on a hub (not Moodle.net) site in Moodle before 2.4.4, information was being sent to the hub regardless of settings chosen (CVE-2013-2081).

There was no check of permissions for viewing comments on blog posts in Moodle before 2.4.4 (CVE-2013-2082).

Form elements named using a specific naming scheme were not being filtered correctly in Moodle before 2.4.4 (CVE-2013-2083).

Record: MGASA-2013-0162
Updated: 2026-11-02

Affected products

moodle

Affected packages

Affected packages
Package	Affected	Fixed
`moodle` Mageia:3 From an advisory covering 5 CVEs	before 2.4.4-1.1.mga3	2.4.4-1.1.mga3

History

History
Recorded	Changed	Sources
Nov 6, 2026	affected, facts
Nov 3, 2026	aliases	EUVD
Nov 2, 2026	first indexed	CVE List, GitHub Advisories, NVD, OSV

Dates are when Every CVE recorded each change. Upstream dates may differ.

In short

CVE-2013-2079 is a medium vulnerability (CVSS 4.0) in Moodle, published May 25, 2013. No source lists public exploit code. EPSS puts the chance of exploitation in the next 30 days at 1.23%, the 69th percentile. No source names a fixed version.

References

Show 9 moreShow less