{"id":"CVE-2013-2243","aliases":["EUVD-2013-2194","GHSA-h46g-v2m5-f7jh","MGASA-2013-0217"],"status":"published","title":"mod/lesson/pagetypes/matching.php in Moodle through 2.2.11, 2.3.x before 2.3.8, 2.4.x before 2.4...","description":"mod/lesson/pagetypes/matching.php in Moodle through 2.2.11, 2.3.x before 2.3.8, 2.4.x before 2.4.5, and 2.5.x before 2.5.1 allows remote authenticated users to obtain sensitive answer information by reading the HTML source code of a document.","severity":{"version":"2.0","score":4,"vector":"AV:N/AC:L/Au:S/C:P/I:N/A:N","level":"medium","assessor":"primary","from":"nvd"},"epss":{"day":"2026-11-09","score":0.01406,"percentile":0.72793,"model":"v2026.06.15"},"facts":{"in_kev":false,"known_exploited":false,"public_exploit":false,"fix_available":false},"cwes":["CWE-200"],"published":"2013-07-21T08:38:57Z","modified":"2026-06-16T23:53:00Z","affected":[{"source":"osv","ecosystem":"Mageia:3","package":"moodle","ranges":[{"type":"ECOSYSTEM","events":[{"introduced":"0"},{"fixed":"2.4.5-1.mga3"}]}],"bundled":5}],"products":[{"vendor":"moodle","product":"moodle"}],"references":[{"url":"https://moodle.org/mod/forum/discuss.php?d=232500","tags":["x_refsource_CONFIRM","x_transferred","Vendor Advisory","web"]},{"url":"http://git.moodle.org/gw?p=moodle.git\u0026a=search\u0026h=HEAD\u0026st=commit\u0026s=MDL-39546","tags":["x_refsource_CONFIRM","x_transferred"]},{"url":"https://nvd.nist.gov/vuln/detail/CVE-2013-2243"},{"url":"https://github.com/advisories/GHSA-h46g-v2m5-f7jh"},{"url":"https://advisories.mageia.org/MGASA-2013-0217.html","tags":["advisory"]},{"url":"https://moodle.org/mod/forum/discuss.php?d=232496","tags":["web"]},{"url":"https://moodle.org/mod/forum/discuss.php?d=232497","tags":["web"]},{"url":"https://moodle.org/mod/forum/discuss.php?d=232498","tags":["web"]},{"url":"https://moodle.org/mod/forum/discuss.php?d=232501","tags":["web"]},{"url":"https://moodle.org/mod/forum/discuss.php?d=232502","tags":["web"]},{"url":"https://moodle.org/mod/forum/discuss.php?d=232503","tags":["web"]},{"url":"http://docs.moodle.org/dev/Moodle_2.4.5_release_notes","tags":["web"]},{"url":"https://moodle.org/mod/forum/discuss.php?d=232108","tags":["web"]},{"url":"https://bugs.mageia.org/show_bug.cgi?id=10755","tags":["report"]}],"sources":{"cve":[{"id":"CVE-2013-2243","description":"mod/lesson/pagetypes/matching.php in Moodle through 2.2.11, 2.3.x before 2.3.8, 2.4.x before 2.4.5, and 2.5.x before 2.5.1 allows remote authenticated users to obtain sensitive answer information by reading the HTML source code of a document.","status":"published","published":"2013-07-26T22:00:00Z","modified":"2024-09-16T22:50:23.594Z","updated_at":"2026-11-02T14:34:56.19172Z"}],"euvd":[{"id":"EUVD-2013-2194","description":"mod/lesson/pagetypes/matching.php in Moodle through 2.2.11, 2.3.x before 2.3.8, 2.4.x before 2.4.5, and 2.5.x before 2.5.1 allows remote authenticated users to obtain sensitive answer information by reading the HTML source code of a document.","status":"published","published":"2013-07-26T22:00:00Z","modified":"2024-09-16T22:50:23Z","updated_at":"2026-11-03T00:54:59.7394Z"}],"ghsa":[{"id":"GHSA-h46g-v2m5-f7jh","title":"mod/lesson/pagetypes/matching.php in Moodle through 2.2.11, 2.3.x before 2.3.8, 2.4.x before 2.4...","description":"mod/lesson/pagetypes/matching.php in Moodle through 2.2.11, 2.3.x before 2.3.8, 2.4.x before 2.4.5, and 2.5.x before 2.5.1 allows remote authenticated users to obtain sensitive answer information by reading the HTML source code of a document.","status":"published","published":"2022-05-13T01:12:52Z","modified":"2023-02-01T05:04:01Z","cwes":["CWE-200"],"updated_at":"2026-11-02T14:50:07.876412Z"}],"nvd":[{"id":"CVE-2013-2243","description":"mod/lesson/pagetypes/matching.php in Moodle through 2.2.11, 2.3.x before 2.3.8, 2.4.x before 2.4.5, and 2.5.x before 2.5.1 allows remote authenticated users to obtain sensitive answer information by reading the HTML source code of a document.","status":"published","published":"2013-07-29T13:59:20.677Z","modified":"2026-06-16T23:53:00.497Z","cvss":[{"version":"2.0","score":4,"vector":"AV:N/AC:L/Au:S/C:P/I:N/A:N","level":"medium","assessor":"primary"}],"cwes":["CWE-200"],"updated_at":"2026-11-02T14:02:31.592595Z"}],"osv":[{"id":"MGASA-2013-0217","title":"Updated moodle package fixes multiple security vulnerabilities","description":"Flash files distributed with the YUI library in Moodle before 2.4.5 may have\nallowed for cross-site scripting attacks (MSA-13-0025).\n\nPrivacy settings for the IMS-LTI (External tool) module in Moodle before\n2.4.5 were not able to be changed so personal information was always\ntransferred (MSA-13-0026).\n\nUsers were able to access a daemon-mode Chat activity in Moodle before 2.4.5\nwithout the required capability (CVE-2013-2242).\n\nIt was possible to determine answers from ID values in Lesson activity\nmatching questions in Moodle before 2.4.5 (CVE-2013-2243).\n\nConditional access rule values for user fields were able to contain unescaped\nHTML/JS that would be output to users in Moodle before 2.4.5 (CVE-2013-2244).\n\nWhen impersonating another user using RSS tokens in Moodle before 2.4.5, an\nerror was displayed, but block information relevant to the person being\nimpersonated was shown (CVE-2013-2245).\n\nThe Feedback module in Moodle before 2.4.5 was showing personal information \nto users without the needed capability (CVE-2013-2246).\n","status":"published","published":"2013-07-21T08:38:57Z","modified":"2026-04-16T04:41:18.867058487Z","updated_at":"2026-11-02T15:49:39.121227Z"}]}}