{"id":"CVE-2013-2081","aliases":["EUVD-2022-5705","GHSA-x3x8-fjw6-hccx","MGASA-2013-0162","UBUNTU-CVE-2013-2081"],"status":"published","title":"Moodle does not consider \"don't send\" attributes during hub registration","description":"Moodle through 2.1.10, 2.2.x before 2.2.10, 2.3.x before 2.3.7, and 2.4.x before 2.4.4 does not consider \"don't send\" attributes during hub registration, which allows remote hubs to obtain sensitive site information by reading form data.","severity":{"version":"2.0","score":4.3,"vector":"AV:N/AC:M/Au:N/C:P/I:N/A:N","level":"medium","assessor":"primary","from":"nvd"},"epss":{"day":"2026-11-08","score":0.01549,"percentile":0.75222,"model":"v2026.06.15"},"facts":{"in_kev":false,"known_exploited":false,"public_exploit":false,"fix_available":true},"cwes":["CWE-264","CWE-284"],"published":"2013-05-25T01:00:00Z","modified":"2026-09-23T18:45:32Z","fixes":[{"ecosystem":"Packagist","package":"moodle/moodle","fixed_in":["2.2.10","2.3.7","2.4.4"],"sources":["ghsa","osv"]}],"affected":[{"source":"ghsa","ecosystem":"Packagist","package":"moodle/moodle","ranges":[{"type":"ECOSYSTEM","events":[{"introduced":"0"},{"fixed":"2.2.10"}]}]},{"source":"ghsa","ecosystem":"Packagist","package":"moodle/moodle","ranges":[{"type":"ECOSYSTEM","events":[{"introduced":"2.3.0"},{"fixed":"2.3.7"}]}]},{"source":"ghsa","ecosystem":"Packagist","package":"moodle/moodle","ranges":[{"type":"ECOSYSTEM","events":[{"introduced":"2.4.0"},{"fixed":"2.4.4"}]}]},{"source":"osv","ecosystem":"Packagist","package":"moodle/moodle","ranges":[{"type":"ECOSYSTEM","events":[{"introduced":"0"},{"fixed":"2.2.10"}]}]},{"source":"osv","ecosystem":"Packagist","package":"moodle/moodle","ranges":[{"type":"ECOSYSTEM","events":[{"introduced":"2.3.0"},{"fixed":"2.3.7"}]}],"versions":["v2.3.4","v2.3.5","v2.3.6"]},{"source":"osv","ecosystem":"Packagist","package":"moodle/moodle","ranges":[{"type":"ECOSYSTEM","events":[{"introduced":"2.4.0"},{"fixed":"2.4.4"}]}],"versions":["v2.4.0","v2.4.1","v2.4.2","v2.4.3"]},{"source":"osv","ecosystem":"Mageia:3","package":"moodle","ranges":[{"type":"ECOSYSTEM","events":[{"introduced":"0"},{"fixed":"2.4.4-1.1.mga3"}]}],"bundled":5},{"source":"osv","ecosystem":"Ubuntu:Pro:16.04:LTS","package":"moodle","ranges":[{"type":"ECOSYSTEM","events":[{"introduced":"0"}]}],"versions":["2.7.9+dfsg-1","2.7.10+dfsg-1","2.7.11+dfsg-1","2.7.11+dfsg-2","2.7.12+dfsg-1","3.0.3+dfsg-0ubuntu1","3.0.3+dfsg-0ubuntu1+esm1"]},{"source":"osv","ecosystem":"Ubuntu:Pro:18.04:LTS","package":"moodle","ranges":[{"type":"ECOSYSTEM","events":[{"introduced":"0"}]}],"versions":["3.0.3+dfsg-0ubuntu1","3.0.3+dfsg-0ubuntu1+esm1"]}],"products":[{"vendor":"moodle","product":"moodle"}],"references":[{"url":"http://git.moodle.org/gw?p=moodle.git\u0026a=search\u0026h=HEAD\u0026st=commit\u0026s=MDL-37822","tags":["x_refsource_CONFIRM","x_transferred","Patch","web","report"]},{"url":"https://moodle.org/mod/forum/discuss.php?d=228933","tags":["x_refsource_CONFIRM","x_transferred","Vendor Advisory","web"]},{"url":"http://lists.fedoraproject.org/pipermail/package-announce/2013-May/106965.html","tags":["vendor-advisory","x_refsource_FEDORA","x_transferred","web"]},{"url":"http://openwall.com/lists/oss-security/2013/05/21/1","tags":["mailing-list","x_refsource_MLIST","x_transferred","web"]},{"url":"http://lists.fedoraproject.org/pipermail/package-announce/2013-May/107026.html","tags":["vendor-advisory","x_refsource_FEDORA","x_transferred","web"]},{"url":"http://lists.fedoraproject.org/pipermail/package-announce/2013-May/106988.html","tags":["vendor-advisory","x_refsource_FEDORA","x_transferred","web"]},{"url":"https://nvd.nist.gov/vuln/detail/CVE-2013-2081","tags":["advisory"]},{"url":"https://github.com/moodle/moodle/commit/1d79b726d762bcc629c1a2a74cfa3eca5a7c5da7","tags":["web"]},{"url":"https://github.com/moodle/moodle/commit/1fc34e37fdc57b4ec303cb942dc5d5535b953ed7","tags":["web"]},{"url":"https://github.com/moodle/moodle/commit/4d65904bc132548a2ef4c2a40bf5ba2cffb5f68f","tags":["web"]},{"url":"https://github.com/moodle/moodle/commit/54a3ce69e9ca751fffd0b3e0eb5be4add50de113","tags":["web"]},{"url":"https://github.com/moodle/moodle/commit/60c468bcb3b6f867a70f2f30427b52e0362e93d1","tags":["web"]},{"url":"https://github.com/moodle/moodle/commit/667eaec4d2679a8bc1fcd9f0ff17a1be2babccb0","tags":["web"]},{"url":"https://github.com/moodle/moodle/commit/669dee58048b18d9034a7b2367b97a50b498b0e0","tags":["web"]},{"url":"https://github.com/moodle/moodle/commit/a811e8ac56e49a174b68ceade81197c80be4b325","tags":["web"]},{"url":"https://github.com/moodle/moodle/commit/be6281e2cbc2fb40b96a48c07c80883fa80cd1b7","tags":["web"]},{"url":"https://github.com/moodle/moodle/commit/fd469033fa2c860647e48f3d543346503a37faa0","tags":["web"]},{"url":"https://github.com/advisories/GHSA-x3x8-fjw6-hccx"},{"url":"https://github.com/moodle/moodle","tags":["package"]},{"url":"https://advisories.mageia.org/MGASA-2013-0162.html","tags":["advisory"]},{"url":"https://moodle.org/mod/forum/discuss.php?d=228930","tags":["web"]},{"url":"https://moodle.org/mod/forum/discuss.php?d=228931","tags":["web"]},{"url":"https://moodle.org/mod/forum/discuss.php?d=228934","tags":["web"]},{"url":"https://moodle.org/mod/forum/discuss.php?d=228935","tags":["web"]},{"url":"http://docs.moodle.org/dev/Moodle_2.4.4_release_notes","tags":["web"]},{"url":"https://moodle.org/mod/forum/discuss.php?d=228536","tags":["web"]},{"url":"https://ubuntu.com/security/CVE-2013-2081","tags":["report"]},{"url":"http://www.openwall.com/lists/oss-security/2013/05/21/1","tags":["report"]},{"url":"https://www.cve.org/CVERecord?id=CVE-2013-2081","tags":["report"]}],"sources":{"cve":[{"id":"CVE-2013-2081","description":"Moodle through 2.1.10, 2.2.x before 2.2.10, 2.3.x before 2.3.7, and 2.4.x before 2.4.4 does not consider \"don't send\" attributes during hub registration, which allows remote hubs to obtain sensitive site information by reading form data.","status":"published","published":"2013-05-25T01:00:00Z","modified":"2024-08-06T15:27:40.86Z","updated_at":"2026-11-02T14:34:55.825574Z"}],"euvd":[{"id":"EUVD-2022-5705","description":"Moodle through 2.1.10, 2.2.x before 2.2.10, 2.3.x before 2.3.7, and 2.4.x before 2.4.4 does not consider \"don't send\" attributes during hub registration, which allows remote hubs to obtain sensitive site information by reading form data.","status":"published","published":"2013-05-25T01:00:00Z","modified":"2024-08-06T15:27:40Z","updated_at":"2026-11-03T01:56:39.604617Z"}],"ghsa":[{"id":"GHSA-x3x8-fjw6-hccx","title":"Moodle does not consider \"don't send\" attributes during hub registration","description":"Moodle through 2.1.10, 2.2.x before 2.2.10, 2.3.x before 2.3.7, and 2.4.x before 2.4.4 does not consider \"don't send\" attributes during hub registration, which allows remote hubs to obtain sensitive site information by reading form data.","status":"published","published":"2022-05-13T01:12:59Z","modified":"2024-01-23T17:50:53Z","cwes":["CWE-284"],"updated_at":"2026-11-02T14:37:32.302254Z"}],"nvd":[{"id":"CVE-2013-2081","description":"Moodle through 2.1.10, 2.2.x before 2.2.10, 2.3.x before 2.3.7, and 2.4.x before 2.4.4 does not consider \"don't send\" attributes during hub registration, which allows remote hubs to obtain sensitive site information by reading form data.","status":"published","published":"2013-05-25T03:18:15.89Z","modified":"2026-06-16T23:52:42.867Z","cvss":[{"version":"2.0","score":4.3,"vector":"AV:N/AC:M/Au:N/C:P/I:N/A:N","level":"medium","assessor":"primary"}],"cwes":["CWE-264"],"updated_at":"2026-11-02T14:02:29.210317Z"}],"osv":[{"id":"GHSA-x3x8-fjw6-hccx","title":"Moodle does not consider \"don't send\" attributes during hub registration","description":"Moodle through 2.1.10, 2.2.x before 2.2.10, 2.3.x before 2.3.7, and 2.4.x before 2.4.4 does not consider \"don't send\" attributes during hub registration, which allows remote hubs to obtain sensitive site information by reading form data.","status":"published","published":"2022-05-13T01:12:59Z","modified":"2024-12-06T05:41:47.395743Z","cwes":["CWE-284"],"updated_at":"2026-11-02T15:46:59.484835Z"},{"id":"MGASA-2013-0162","title":"Updated moodle package fix security vulnerabilities","description":"The assignment module in Moodle before 2.4.4 was not checking capabilities\nfor users downloading all assignments as a zip (CVE-2013-2079).\n\nThe Gradebook's Overview report in Moodle before 2.4.4 was showing grade\ntotals that may have incorrectly included hidden grades (CVE-2013-2080).\n\nWhen registering a site on a hub (not Moodle.net) site in Moodle before\n2.4.4, information was being sent to the hub regardless of settings chosen\n(CVE-2013-2081).\n\nThere was no check of permissions for viewing comments on blog posts in\nMoodle before 2.4.4 (CVE-2013-2082).\n\nForm elements named using a specific naming scheme were not being filtered\ncorrectly in Moodle before 2.4.4 (CVE-2013-2083).\n","status":"published","published":"2013-06-06T12:24:33Z","modified":"2026-04-16T06:24:12.744555975Z","updated_at":"2026-11-02T15:49:39.121227Z"},{"id":"UBUNTU-CVE-2013-2081","description":"Moodle through 2.1.10, 2.2.x before 2.2.10, 2.3.x before 2.3.7, and 2.4.x before 2.4.4 does not consider \"don't send\" attributes during hub registration, which allows remote hubs to obtain sensitive site information by reading form data.","status":"published","published":"2013-05-25T03:18:00Z","modified":"2026-09-23T18:45:32.694008368Z","updated_at":"2026-11-02T15:54:06.854805Z"}]}}