{"id":"CVE-2013-2080","aliases":["EUVD-2022-5600","GHSA-wmmc-qjq2-vvm2","MGASA-2013-0162","UBUNTU-CVE-2013-2080"],"status":"published","title":"Moodle is vulnerable to Sensitive Information Disclosure","description":"The core_grade component in Moodle through 2.2.10, 2.3.x before 2.3.7, and 2.4.x before 2.4.4 does not properly consider the existence of hidden grades, which allows remote authenticated users to obtain sensitive information by leveraging the student role and reading the Gradebook Overview report.","severity":{"version":"2.0","score":4,"vector":"AV:N/AC:L/Au:S/C:P/I:N/A:N","level":"medium","assessor":"primary","from":"nvd"},"epss":{"day":"2026-11-08","score":0.01825,"percentile":0.78953,"model":"v2026.06.15"},"facts":{"in_kev":false,"known_exploited":false,"public_exploit":false,"fix_available":true},"cwes":["CWE-200","CWE-264"],"published":"2013-05-25T01:00:00Z","modified":"2026-09-23T18:45:32Z","fixes":[{"ecosystem":"Packagist","package":"moodle/moodle","fixed_in":["2.4.4","2.3.7"],"sources":["ghsa","osv"]}],"affected":[{"source":"ghsa","ecosystem":"Packagist","package":"moodle/moodle","ranges":[{"type":"ECOSYSTEM","events":[{"introduced":"2.4.0"},{"fixed":"2.4.4"}]}]},{"source":"ghsa","ecosystem":"Packagist","package":"moodle/moodle","ranges":[{"type":"ECOSYSTEM","events":[{"introduced":"0"},{"fixed":"2.3.7"}]}]},{"source":"osv","ecosystem":"Packagist","package":"moodle/moodle","ranges":[{"type":"ECOSYSTEM","events":[{"introduced":"0"},{"fixed":"2.3.7"}]}],"versions":["v2.3.4","v2.3.5","v2.3.6"]},{"source":"osv","ecosystem":"Packagist","package":"moodle/moodle","ranges":[{"type":"ECOSYSTEM","events":[{"introduced":"2.4.0"},{"fixed":"2.4.4"}]}],"versions":["v2.4.0","v2.4.1","v2.4.2","v2.4.3"]},{"source":"osv","ecosystem":"Mageia:3","package":"moodle","ranges":[{"type":"ECOSYSTEM","events":[{"introduced":"0"},{"fixed":"2.4.4-1.1.mga3"}]}],"bundled":5},{"source":"osv","ecosystem":"Ubuntu:Pro:16.04:LTS","package":"moodle","ranges":[{"type":"ECOSYSTEM","events":[{"introduced":"0"}]}],"versions":["2.7.9+dfsg-1","2.7.10+dfsg-1","2.7.11+dfsg-1","2.7.11+dfsg-2","2.7.12+dfsg-1","3.0.3+dfsg-0ubuntu1","3.0.3+dfsg-0ubuntu1+esm1"]},{"source":"osv","ecosystem":"Ubuntu:Pro:18.04:LTS","package":"moodle","ranges":[{"type":"ECOSYSTEM","events":[{"introduced":"0"}]}],"versions":["3.0.3+dfsg-0ubuntu1","3.0.3+dfsg-0ubuntu1+esm1"]}],"products":[{"vendor":"moodle","product":"moodle"}],"references":[{"url":"http://git.moodle.org/gw?p=moodle.git\u0026a=search\u0026h=HEAD\u0026st=commit\u0026s=MDL-37475","tags":["x_refsource_CONFIRM","x_transferred","Patch","web","report"]},{"url":"http://lists.fedoraproject.org/pipermail/package-announce/2013-May/106965.html","tags":["vendor-advisory","x_refsource_FEDORA","x_transferred","web"]},{"url":"http://openwall.com/lists/oss-security/2013/05/21/1","tags":["mailing-list","x_refsource_MLIST","x_transferred","web"]},{"url":"http://lists.fedoraproject.org/pipermail/package-announce/2013-May/107026.html","tags":["vendor-advisory","x_refsource_FEDORA","x_transferred","web"]},{"url":"http://lists.fedoraproject.org/pipermail/package-announce/2013-May/106988.html","tags":["vendor-advisory","x_refsource_FEDORA","x_transferred","web"]},{"url":"https://moodle.org/mod/forum/discuss.php?d=228931","tags":["x_refsource_CONFIRM","x_transferred","Vendor Advisory","web"]},{"url":"https://nvd.nist.gov/vuln/detail/CVE-2013-2080","tags":["advisory"]},{"url":"https://github.com/moodle/moodle/commit/4b280ca67972479b4b86dd8861bcbeb8c06e41f9","tags":["web"]},{"url":"https://github.com/moodle/moodle/commit/5df9bc3998095299c6862973866252649a5e0866","tags":["web"]},{"url":"https://github.com/moodle/moodle/commit/bf5f227817ec65cfdf76d4bdc961af81a701bc31","tags":["web"]},{"url":"https://github.com/advisories/GHSA-wmmc-qjq2-vvm2"},{"url":"https://github.com/moodle/moodle","tags":["package"]},{"url":"https://advisories.mageia.org/MGASA-2013-0162.html","tags":["advisory"]},{"url":"https://moodle.org/mod/forum/discuss.php?d=228930","tags":["web"]},{"url":"https://moodle.org/mod/forum/discuss.php?d=228933","tags":["web"]},{"url":"https://moodle.org/mod/forum/discuss.php?d=228934","tags":["web"]},{"url":"https://moodle.org/mod/forum/discuss.php?d=228935","tags":["web"]},{"url":"http://docs.moodle.org/dev/Moodle_2.4.4_release_notes","tags":["web"]},{"url":"https://moodle.org/mod/forum/discuss.php?d=228536","tags":["web"]},{"url":"https://ubuntu.com/security/CVE-2013-2080","tags":["report"]},{"url":"http://www.openwall.com/lists/oss-security/2013/05/21/1","tags":["report"]},{"url":"https://www.cve.org/CVERecord?id=CVE-2013-2080","tags":["report"]}],"sources":{"cve":[{"id":"CVE-2013-2080","description":"The core_grade component in Moodle through 2.2.10, 2.3.x before 2.3.7, and 2.4.x before 2.4.4 does not properly consider the existence of hidden grades, which allows remote authenticated users to obtain sensitive information by leveraging the student role and reading the Gradebook Overview report.","status":"published","published":"2013-05-25T01:00:00Z","modified":"2024-08-06T15:27:40.651Z","updated_at":"2026-11-02T14:34:55.825574Z"}],"euvd":[{"id":"EUVD-2022-5600","description":"The core_grade component in Moodle through 2.2.10, 2.3.x before 2.3.7, and 2.4.x before 2.4.4 does not properly consider the existence of hidden grades, which allows remote authenticated users to obtain sensitive information by leveraging the student role and reading the Gradebook Overview report.","status":"published","published":"2013-05-25T01:00:00Z","modified":"2024-08-06T15:27:40Z","updated_at":"2026-11-03T01:56:39.604617Z"}],"ghsa":[{"id":"GHSA-wmmc-qjq2-vvm2","title":"Moodle is vulnerable to Sensitive Information Disclosure","description":"The core_grade component in Moodle through 2.2.10, 2.3.x before 2.3.7, and 2.4.x before 2.4.4 does not properly consider the existence of hidden grades, which allows remote authenticated users to obtain sensitive information by leveraging the student role and reading the Gradebook Overview report.","status":"published","published":"2022-05-13T01:12:58Z","modified":"2024-01-23T15:23:21Z","cwes":["CWE-200"],"updated_at":"2026-11-02T14:37:32.302254Z"}],"nvd":[{"id":"CVE-2013-2080","description":"The core_grade component in Moodle through 2.2.10, 2.3.x before 2.3.7, and 2.4.x before 2.4.4 does not properly consider the existence of hidden grades, which allows remote authenticated users to obtain sensitive information by leveraging the student role and reading the Gradebook Overview report.","status":"published","published":"2013-05-25T03:18:15.867Z","modified":"2026-06-16T23:52:42.743Z","cvss":[{"version":"2.0","score":4,"vector":"AV:N/AC:L/Au:S/C:P/I:N/A:N","level":"medium","assessor":"primary"}],"cwes":["CWE-264"],"updated_at":"2026-11-02T14:02:29.210317Z"}],"osv":[{"id":"GHSA-wmmc-qjq2-vvm2","title":"Moodle is vulnerable to Sensitive Information Disclosure","description":"The core_grade component in Moodle through 2.2.10, 2.3.x before 2.3.7, and 2.4.x before 2.4.4 does not properly consider the existence of hidden grades, which allows remote authenticated users to obtain sensitive information by leveraging the student role and reading the Gradebook Overview report.","status":"published","published":"2022-05-13T01:12:58Z","modified":"2024-12-06T05:40:05.461007Z","cwes":["CWE-200"],"updated_at":"2026-11-02T15:46:58.767335Z"},{"id":"MGASA-2013-0162","title":"Updated moodle package fix security vulnerabilities","description":"The assignment module in Moodle before 2.4.4 was not checking capabilities\nfor users downloading all assignments as a zip (CVE-2013-2079).\n\nThe Gradebook's Overview report in Moodle before 2.4.4 was showing grade\ntotals that may have incorrectly included hidden grades (CVE-2013-2080).\n\nWhen registering a site on a hub (not Moodle.net) site in Moodle before\n2.4.4, information was being sent to the hub regardless of settings chosen\n(CVE-2013-2081).\n\nThere was no check of permissions for viewing comments on blog posts in\nMoodle before 2.4.4 (CVE-2013-2082).\n\nForm elements named using a specific naming scheme were not being filtered\ncorrectly in Moodle before 2.4.4 (CVE-2013-2083).\n","status":"published","published":"2013-06-06T12:24:33Z","modified":"2026-04-16T06:24:12.744555975Z","updated_at":"2026-11-02T15:49:39.121227Z"},{"id":"UBUNTU-CVE-2013-2080","description":"The core_grade component in Moodle through 2.2.10, 2.3.x before 2.3.7, and 2.4.x before 2.4.4 does not properly consider the existence of hidden grades, which allows remote authenticated users to obtain sensitive information by leveraging the student role and reading the Gradebook Overview report.","status":"published","published":"2013-05-25T03:18:00Z","modified":"2026-09-23T18:45:32.669158783Z","updated_at":"2026-11-02T15:54:06.854805Z"}]}}