{"id":"CVE-2013-2082","aliases":["EUVD-2022-5609","GHSA-wp3g-pr4h-q6vv","MGASA-2013-0162","UBUNTU-CVE-2013-2082"],"status":"published","title":"Moodle does not enforce capability requirements for reading blog comments","description":"Moodle through 2.1.10, 2.2.x before 2.2.10, 2.3.x before 2.3.7, and 2.4.x before 2.4.4 does not enforce capability requirements for reading blog comments, which allows remote attackers to obtain sensitive information via a crafted request.","severity":{"version":"2.0","score":5,"vector":"AV:N/AC:L/Au:N/C:P/I:N/A:N","level":"medium","assessor":"primary","from":"nvd"},"epss":{"day":"2026-11-08","score":0.02308,"percentile":0.83477,"model":"v2026.06.15"},"facts":{"in_kev":false,"known_exploited":false,"public_exploit":false,"fix_available":true},"cwes":["CWE-264"],"published":"2013-05-25T01:00:00Z","modified":"2026-09-23T18:45:55Z","fixes":[{"ecosystem":"Packagist","package":"moodle/moodle","fixed_in":["2.2.10","2.3.7","2.4.4"],"sources":["ghsa","osv"]}],"affected":[{"source":"ghsa","ecosystem":"Packagist","package":"moodle/moodle","ranges":[{"type":"ECOSYSTEM","events":[{"introduced":"0"},{"fixed":"2.2.10"}]}]},{"source":"ghsa","ecosystem":"Packagist","package":"moodle/moodle","ranges":[{"type":"ECOSYSTEM","events":[{"introduced":"2.3.0"},{"fixed":"2.3.7"}]}]},{"source":"ghsa","ecosystem":"Packagist","package":"moodle/moodle","ranges":[{"type":"ECOSYSTEM","events":[{"introduced":"2.4.0"},{"fixed":"2.4.4"}]}]},{"source":"osv","ecosystem":"Packagist","package":"moodle/moodle","ranges":[{"type":"ECOSYSTEM","events":[{"introduced":"0"},{"fixed":"2.2.10"}]}]},{"source":"osv","ecosystem":"Packagist","package":"moodle/moodle","ranges":[{"type":"ECOSYSTEM","events":[{"introduced":"2.3.0"},{"fixed":"2.3.7"}]}],"versions":["v2.3.4","v2.3.5","v2.3.6"]},{"source":"osv","ecosystem":"Packagist","package":"moodle/moodle","ranges":[{"type":"ECOSYSTEM","events":[{"introduced":"2.4.0"},{"fixed":"2.4.4"}]}],"versions":["v2.4.0","v2.4.1","v2.4.2","v2.4.3"]},{"source":"osv","ecosystem":"Mageia:3","package":"moodle","ranges":[{"type":"ECOSYSTEM","events":[{"introduced":"0"},{"fixed":"2.4.4-1.1.mga3"}]}],"bundled":5},{"source":"osv","ecosystem":"Ubuntu:Pro:16.04:LTS","package":"moodle","ranges":[{"type":"ECOSYSTEM","events":[{"introduced":"0"}]}],"versions":["2.7.9+dfsg-1","2.7.10+dfsg-1","2.7.11+dfsg-1","2.7.11+dfsg-2","2.7.12+dfsg-1","3.0.3+dfsg-0ubuntu1","3.0.3+dfsg-0ubuntu1+esm1"]},{"source":"osv","ecosystem":"Ubuntu:Pro:18.04:LTS","package":"moodle","ranges":[{"type":"ECOSYSTEM","events":[{"introduced":"0"}]}],"versions":["3.0.3+dfsg-0ubuntu1","3.0.3+dfsg-0ubuntu1+esm1"]}],"products":[{"vendor":"moodle","product":"moodle"}],"references":[{"url":"http://git.moodle.org/gw?p=moodle.git\u0026a=search\u0026h=HEAD\u0026st=commit\u0026s=MDL-37245","tags":["x_refsource_CONFIRM","x_transferred","Patch","web","report"]},{"url":"http://lists.fedoraproject.org/pipermail/package-announce/2013-May/106965.html","tags":["vendor-advisory","x_refsource_FEDORA","x_transferred","web"]},{"url":"http://openwall.com/lists/oss-security/2013/05/21/1","tags":["mailing-list","x_refsource_MLIST","x_transferred","web"]},{"url":"http://lists.fedoraproject.org/pipermail/package-announce/2013-May/107026.html","tags":["vendor-advisory","x_refsource_FEDORA","x_transferred","web"]},{"url":"https://moodle.org/mod/forum/discuss.php?d=228934","tags":["x_refsource_CONFIRM","x_transferred","Vendor Advisory","web"]},{"url":"http://lists.fedoraproject.org/pipermail/package-announce/2013-May/106988.html","tags":["vendor-advisory","x_refsource_FEDORA","x_transferred","web"]},{"url":"https://nvd.nist.gov/vuln/detail/CVE-2013-2082","tags":["advisory"]},{"url":"https://github.com/moodle/moodle/commit/28772fb9e7e6be01b765fb721af16901bb47e417","tags":["web"]},{"url":"https://github.com/moodle/moodle/commit/5fde58a59335bc3109a9eaac4a15d1e9217541c3","tags":["web"]},{"url":"https://github.com/moodle/moodle/commit/8aa12adcf26ff2f0b61cd6f0288f2886c8c55bf7","tags":["web"]},{"url":"https://github.com/moodle/moodle/commit/9a909b1a359f72b8d384e18da8e05474604279e1","tags":["web"]},{"url":"https://github.com/moodle/moodle/commit/cb538f0e539e833edb7cf6fa3d705e8abc5003fd","tags":["web"]},{"url":"https://github.com/moodle/moodle/commit/f9e27e8323f31186820d25252ec0d4c6cd65dafc","tags":["web"]},{"url":"https://github.com/advisories/GHSA-wp3g-pr4h-q6vv"},{"url":"https://github.com/moodle/moodle","tags":["package"]},{"url":"https://advisories.mageia.org/MGASA-2013-0162.html","tags":["advisory"]},{"url":"https://moodle.org/mod/forum/discuss.php?d=228930","tags":["web"]},{"url":"https://moodle.org/mod/forum/discuss.php?d=228931","tags":["web"]},{"url":"https://moodle.org/mod/forum/discuss.php?d=228933","tags":["web"]},{"url":"https://moodle.org/mod/forum/discuss.php?d=228935","tags":["web"]},{"url":"http://docs.moodle.org/dev/Moodle_2.4.4_release_notes","tags":["web"]},{"url":"https://moodle.org/mod/forum/discuss.php?d=228536","tags":["web"]},{"url":"https://ubuntu.com/security/CVE-2013-2082","tags":["report"]},{"url":"http://www.openwall.com/lists/oss-security/2013/05/21/1","tags":["report"]},{"url":"https://www.cve.org/CVERecord?id=CVE-2013-2082","tags":["report"]}],"sources":{"cve":[{"id":"CVE-2013-2082","description":"Moodle through 2.1.10, 2.2.x before 2.2.10, 2.3.x before 2.3.7, and 2.4.x before 2.4.4 does not enforce capability requirements for reading blog comments, which allows remote attackers to obtain sensitive information via a crafted request.","status":"published","published":"2013-05-25T01:00:00Z","modified":"2024-08-06T15:27:40.671Z","updated_at":"2026-11-02T14:34:56.19172Z"}],"euvd":[{"id":"EUVD-2022-5609","description":"Moodle through 2.1.10, 2.2.x before 2.2.10, 2.3.x before 2.3.7, and 2.4.x before 2.4.4 does not enforce capability requirements for reading blog comments, which allows remote attackers to obtain sensitive information via a crafted request.","status":"published","published":"2013-05-25T01:00:00Z","modified":"2024-08-06T15:27:40Z","updated_at":"2026-11-03T01:56:39.604617Z"}],"ghsa":[{"id":"GHSA-wp3g-pr4h-q6vv","title":"Moodle does not enforce capability requirements for reading blog comments","description":"Moodle through 2.1.10, 2.2.x before 2.2.10, 2.3.x before 2.3.7, and 2.4.x before 2.4.4 does not enforce capability requirements for reading blog comments, which allows remote attackers to obtain sensitive information via a crafted request.","status":"published","published":"2022-05-13T01:12:59Z","modified":"2024-01-23T17:51:13Z","updated_at":"2026-11-02T14:37:32.302254Z"}],"nvd":[{"id":"CVE-2013-2082","description":"Moodle through 2.1.10, 2.2.x before 2.2.10, 2.3.x before 2.3.7, and 2.4.x before 2.4.4 does not enforce capability requirements for reading blog comments, which allows remote attackers to obtain sensitive information via a crafted request.","status":"published","published":"2013-05-25T03:18:15.91Z","modified":"2026-06-16T23:52:42.97Z","cvss":[{"version":"2.0","score":5,"vector":"AV:N/AC:L/Au:N/C:P/I:N/A:N","level":"medium","assessor":"primary"}],"cwes":["CWE-264"],"updated_at":"2026-11-02T14:02:29.210317Z"}],"osv":[{"id":"GHSA-wp3g-pr4h-q6vv","title":"Moodle does not enforce capability requirements for reading blog comments","description":"Moodle through 2.1.10, 2.2.x before 2.2.10, 2.3.x before 2.3.7, and 2.4.x before 2.4.4 does not enforce capability requirements for reading blog comments, which allows remote attackers to obtain sensitive information via a crafted request.","status":"published","published":"2022-05-13T01:12:59Z","modified":"2024-12-06T05:47:38.454493Z","updated_at":"2026-11-02T15:46:58.767335Z"},{"id":"MGASA-2013-0162","title":"Updated moodle package fix security vulnerabilities","description":"The assignment module in Moodle before 2.4.4 was not checking capabilities\nfor users downloading all assignments as a zip (CVE-2013-2079).\n\nThe Gradebook's Overview report in Moodle before 2.4.4 was showing grade\ntotals that may have incorrectly included hidden grades (CVE-2013-2080).\n\nWhen registering a site on a hub (not Moodle.net) site in Moodle before\n2.4.4, information was being sent to the hub regardless of settings chosen\n(CVE-2013-2081).\n\nThere was no check of permissions for viewing comments on blog posts in\nMoodle before 2.4.4 (CVE-2013-2082).\n\nForm elements named using a specific naming scheme were not being filtered\ncorrectly in Moodle before 2.4.4 (CVE-2013-2083).\n","status":"published","published":"2013-06-06T12:24:33Z","modified":"2026-04-16T06:24:12.744555975Z","updated_at":"2026-11-02T15:49:39.121227Z"},{"id":"UBUNTU-CVE-2013-2082","description":"Moodle through 2.1.10, 2.2.x before 2.2.10, 2.3.x before 2.3.7, and 2.4.x before 2.4.4 does not enforce capability requirements for reading blog comments, which allows remote attackers to obtain sensitive information via a crafted request.","status":"published","published":"2013-05-25T03:18:00Z","modified":"2026-09-23T18:45:55.318753696Z","updated_at":"2026-11-02T15:54:06.854805Z"}]}}