{"id":"CVE-2013-2083","aliases":["EUVD-2022-4498","GHSA-m63h-q4x3-6hwj","MGASA-2013-0162","UBUNTU-CVE-2013-2083"],"status":"published","title":"Moodle is vulnerable to Improper Input Validation in MoodleQuickForm class","description":"The MoodleQuickForm class in lib/formslib.php in Moodle through 2.1.10, 2.2.x before 2.2.10, 2.3.x before 2.3.7, and 2.4.x before 2.4.4 does not properly handle a certain array-element syntax, which allows remote attackers to bypass intended form-data filtering via a crafted request.","severity":{"version":"2.0","score":5,"vector":"AV:N/AC:L/Au:N/C:N/I:P/A:N","level":"medium","assessor":"primary","from":"nvd"},"epss":{"day":"2026-11-08","score":0.02342,"percentile":0.83746,"model":"v2026.06.15"},"facts":{"in_kev":false,"known_exploited":false,"public_exploit":false,"fix_available":true},"cwes":["CWE-20"],"published":"2013-05-25T01:00:00Z","modified":"2026-09-23T18:45:55Z","fixes":[{"ecosystem":"Packagist","package":"moodle/moodle","fixed_in":["2.3.7","2.4.4","2.2.10"],"sources":["ghsa","osv"]}],"affected":[{"source":"ghsa","ecosystem":"Packagist","package":"moodle/moodle","ranges":[{"type":"ECOSYSTEM","events":[{"introduced":"2.3.0"},{"fixed":"2.3.7"}]}]},{"source":"ghsa","ecosystem":"Packagist","package":"moodle/moodle","ranges":[{"type":"ECOSYSTEM","events":[{"introduced":"2.4.0"},{"fixed":"2.4.4"}]}]},{"source":"ghsa","ecosystem":"Packagist","package":"moodle/moodle","ranges":[{"type":"ECOSYSTEM","events":[{"introduced":"0"},{"fixed":"2.2.10"}]}]},{"source":"osv","ecosystem":"Packagist","package":"moodle/moodle","ranges":[{"type":"ECOSYSTEM","events":[{"introduced":"0"},{"fixed":"2.2.10"}]}]},{"source":"osv","ecosystem":"Packagist","package":"moodle/moodle","ranges":[{"type":"ECOSYSTEM","events":[{"introduced":"2.3.0"},{"fixed":"2.3.7"}]}],"versions":["v2.3.4","v2.3.5","v2.3.6"]},{"source":"osv","ecosystem":"Packagist","package":"moodle/moodle","ranges":[{"type":"ECOSYSTEM","events":[{"introduced":"2.4.0"},{"fixed":"2.4.4"}]}],"versions":["v2.4.0","v2.4.1","v2.4.2","v2.4.3"]},{"source":"osv","ecosystem":"Mageia:3","package":"moodle","ranges":[{"type":"ECOSYSTEM","events":[{"introduced":"0"},{"fixed":"2.4.4-1.1.mga3"}]}],"bundled":5},{"source":"osv","ecosystem":"Ubuntu:Pro:16.04:LTS","package":"moodle","ranges":[{"type":"ECOSYSTEM","events":[{"introduced":"0"}]}],"versions":["2.7.9+dfsg-1","2.7.10+dfsg-1","2.7.11+dfsg-1","2.7.11+dfsg-2","2.7.12+dfsg-1","3.0.3+dfsg-0ubuntu1","3.0.3+dfsg-0ubuntu1+esm1"]},{"source":"osv","ecosystem":"Ubuntu:Pro:18.04:LTS","package":"moodle","ranges":[{"type":"ECOSYSTEM","events":[{"introduced":"0"}]}],"versions":["3.0.3+dfsg-0ubuntu1","3.0.3+dfsg-0ubuntu1+esm1"]}],"products":[{"vendor":"moodle","product":"moodle"}],"references":[{"url":"http://lists.fedoraproject.org/pipermail/package-announce/2013-May/106965.html","tags":["vendor-advisory","x_refsource_FEDORA","x_transferred","web"]},{"url":"http://git.moodle.org/gw?p=moodle.git\u0026a=search\u0026h=HEAD\u0026st=commit\u0026s=MDL-38885","tags":["x_refsource_CONFIRM","x_transferred","Patch","web","report"]},{"url":"http://openwall.com/lists/oss-security/2013/05/21/1","tags":["mailing-list","x_refsource_MLIST","x_transferred","web"]},{"url":"http://lists.fedoraproject.org/pipermail/package-announce/2013-May/107026.html","tags":["vendor-advisory","x_refsource_FEDORA","x_transferred","web"]},{"url":"http://lists.fedoraproject.org/pipermail/package-announce/2013-May/106988.html","tags":["vendor-advisory","x_refsource_FEDORA","x_transferred","web"]},{"url":"https://moodle.org/mod/forum/discuss.php?d=228935","tags":["x_refsource_CONFIRM","x_transferred","Vendor Advisory","web"]},{"url":"https://nvd.nist.gov/vuln/detail/CVE-2013-2083","tags":["advisory"]},{"url":"https://github.com/moodle/moodle/commit/3c0ba94e879702b3c2f20d4cb4f9120a0bfdd9fc","tags":["web"]},{"url":"https://github.com/moodle/moodle/commit/8a9c3f4951e05eea80775d8c82d00a64434376c7","tags":["web"]},{"url":"https://github.com/moodle/moodle/commit/cc2fb80742af94edde20b6b57da24027f2884a24","tags":["web"]},{"url":"https://github.com/moodle/moodle/commit/d39925c792789230e628548ecff9ca34d0a74c16","tags":["web"]},{"url":"https://github.com/moodle/moodle/commit/d5909fd1447bc6f05dbf37d7c9eb72b79004e24a","tags":["web"]},{"url":"https://github.com/moodle/moodle/commit/e4e1bd900a2fb73e81d761bf8a5b9d2d162073d6","tags":["web"]},{"url":"https://github.com/moodle/moodle/commit/e8ca6884531a3162cf755d7c09c29e7933c84090","tags":["web"]},{"url":"https://github.com/moodle/moodle/commit/eb5852672e5e45fd95b28aab58bad080b15a7b6d","tags":["web"]},{"url":"https://github.com/moodle/moodle/commit/feeb14b9410cac5a9da7437f8cb663e6ada9c9d4","tags":["web"]},{"url":"https://github.com/advisories/GHSA-m63h-q4x3-6hwj"},{"url":"https://github.com/moodle/moodle","tags":["package"]},{"url":"https://advisories.mageia.org/MGASA-2013-0162.html","tags":["advisory"]},{"url":"https://moodle.org/mod/forum/discuss.php?d=228930","tags":["web"]},{"url":"https://moodle.org/mod/forum/discuss.php?d=228931","tags":["web"]},{"url":"https://moodle.org/mod/forum/discuss.php?d=228933","tags":["web"]},{"url":"https://moodle.org/mod/forum/discuss.php?d=228934","tags":["web"]},{"url":"http://docs.moodle.org/dev/Moodle_2.4.4_release_notes","tags":["web"]},{"url":"https://moodle.org/mod/forum/discuss.php?d=228536","tags":["web"]},{"url":"https://ubuntu.com/security/CVE-2013-2083","tags":["report"]},{"url":"http://www.openwall.com/lists/oss-security/2013/05/21/1","tags":["report"]},{"url":"https://www.cve.org/CVERecord?id=CVE-2013-2083","tags":["report"]}],"sources":{"cve":[{"id":"CVE-2013-2083","description":"The MoodleQuickForm class in lib/formslib.php in Moodle through 2.1.10, 2.2.x before 2.2.10, 2.3.x before 2.3.7, and 2.4.x before 2.4.4 does not properly handle a certain array-element syntax, which allows remote attackers to bypass intended form-data filtering via a crafted request.","status":"published","published":"2013-05-25T01:00:00Z","modified":"2024-08-06T15:27:40.868Z","updated_at":"2026-11-02T14:34:56.19172Z"}],"euvd":[{"id":"EUVD-2022-4498","description":"The MoodleQuickForm class in lib/formslib.php in Moodle through 2.1.10, 2.2.x before 2.2.10, 2.3.x before 2.3.7, and 2.4.x before 2.4.4 does not properly handle a certain array-element syntax, which allows remote attackers to bypass intended form-data filtering via a crafted request.","status":"published","published":"2013-05-25T01:00:00Z","modified":"2024-08-06T15:27:40Z","updated_at":"2026-11-03T01:56:39.604617Z"}],"ghsa":[{"id":"GHSA-m63h-q4x3-6hwj","title":"Moodle is vulnerable to Improper Input Validation in MoodleQuickForm class","description":"The MoodleQuickForm class in `lib/formslib.php` in Moodle through 2.1.10, 2.2.x before 2.2.10, 2.3.x before 2.3.7, and 2.4.x before 2.4.4 does not properly handle a certain array-element syntax, which allows remote attackers to bypass intended form-data filtering via a crafted request.","status":"published","published":"2022-05-13T01:12:59Z","modified":"2024-01-23T16:09:04Z","cwes":["CWE-20"],"updated_at":"2026-11-02T14:37:32.302254Z"}],"nvd":[{"id":"CVE-2013-2083","description":"The MoodleQuickForm class in lib/formslib.php in Moodle through 2.1.10, 2.2.x before 2.2.10, 2.3.x before 2.3.7, and 2.4.x before 2.4.4 does not properly handle a certain array-element syntax, which allows remote attackers to bypass intended form-data filtering via a crafted request.","status":"published","published":"2013-05-25T03:18:15.937Z","modified":"2026-06-16T23:52:43.08Z","cvss":[{"version":"2.0","score":5,"vector":"AV:N/AC:L/Au:N/C:N/I:P/A:N","level":"medium","assessor":"primary"}],"cwes":["CWE-20"],"updated_at":"2026-11-02T14:02:29.210317Z"}],"osv":[{"id":"GHSA-m63h-q4x3-6hwj","title":"Moodle is vulnerable to Improper Input Validation in MoodleQuickForm class","description":"The MoodleQuickForm class in `lib/formslib.php` in Moodle through 2.1.10, 2.2.x before 2.2.10, 2.3.x before 2.3.7, and 2.4.x before 2.4.4 does not properly handle a certain array-element syntax, which allows remote attackers to bypass intended form-data filtering via a crafted request.","status":"published","published":"2022-05-13T01:12:59Z","modified":"2024-12-06T05:39:09.165795Z","cwes":["CWE-20"],"updated_at":"2026-11-02T15:46:51.463834Z"},{"id":"MGASA-2013-0162","title":"Updated moodle package fix security vulnerabilities","description":"The assignment module in Moodle before 2.4.4 was not checking capabilities\nfor users downloading all assignments as a zip (CVE-2013-2079).\n\nThe Gradebook's Overview report in Moodle before 2.4.4 was showing grade\ntotals that may have incorrectly included hidden grades (CVE-2013-2080).\n\nWhen registering a site on a hub (not Moodle.net) site in Moodle before\n2.4.4, information was being sent to the hub regardless of settings chosen\n(CVE-2013-2081).\n\nThere was no check of permissions for viewing comments on blog posts in\nMoodle before 2.4.4 (CVE-2013-2082).\n\nForm elements named using a specific naming scheme were not being filtered\ncorrectly in Moodle before 2.4.4 (CVE-2013-2083).\n","status":"published","published":"2013-06-06T12:24:33Z","modified":"2026-04-16T06:24:12.744555975Z","updated_at":"2026-11-02T15:49:39.121227Z"},{"id":"UBUNTU-CVE-2013-2083","description":"The MoodleQuickForm class in lib/formslib.php in Moodle through 2.1.10, 2.2.x before 2.2.10, 2.3.x before 2.3.7, and 2.4.x before 2.4.4 does not properly handle a certain array-element syntax, which allows remote attackers to bypass intended form-data filtering via a crafted request.","status":"published","published":"2013-05-25T03:18:00Z","modified":"2026-09-23T18:45:55.202999661Z","updated_at":"2026-11-02T15:54:06.854805Z"}]}}