{"id":"CVE-2013-2245","aliases":["EUVD-2013-2196","GHSA-9r38-f9p6-3f7p","MGASA-2013-0217"],"status":"published","title":"rss/file.php in Moodle through 2.1.10, 2.2.x before 2.2.11, 2.3.x before 2.3.8, 2.4.x before 2.4...","description":"rss/file.php in Moodle through 2.1.10, 2.2.x before 2.2.11, 2.3.x before 2.3.8, 2.4.x before 2.4.5, and 2.5.x before 2.5.1 does not properly implement the use of RSS tokens for impersonation, which allows remote authenticated users to obtain sensitive block information by reading an RSS feed.","severity":{"version":"2.0","score":4,"vector":"AV:N/AC:L/Au:S/C:P/I:N/A:N","level":"medium","assessor":"primary","from":"nvd"},"epss":{"day":"2026-11-09","score":0.0093,"percentile":0.60849,"model":"v2026.06.15"},"facts":{"in_kev":false,"known_exploited":false,"public_exploit":false,"fix_available":false},"cwes":["CWE-287"],"published":"2013-07-21T08:38:57Z","modified":"2026-06-16T23:53:00Z","affected":[{"source":"osv","ecosystem":"Mageia:3","package":"moodle","ranges":[{"type":"ECOSYSTEM","events":[{"introduced":"0"},{"fixed":"2.4.5-1.mga3"}]}],"bundled":5}],"products":[{"vendor":"moodle","product":"moodle"}],"references":[{"url":"http://git.moodle.org/gw?p=moodle.git\u0026a=search\u0026h=HEAD\u0026st=commit\u0026s=MDL-37818","tags":["x_refsource_CONFIRM","x_transferred"]},{"url":"https://moodle.org/mod/forum/discuss.php?d=232502","tags":["x_refsource_CONFIRM","x_transferred","web"]},{"url":"https://nvd.nist.gov/vuln/detail/CVE-2013-2245"},{"url":"https://github.com/advisories/GHSA-9r38-f9p6-3f7p"},{"url":"https://advisories.mageia.org/MGASA-2013-0217.html","tags":["advisory"]},{"url":"https://moodle.org/mod/forum/discuss.php?d=232496","tags":["web"]},{"url":"https://moodle.org/mod/forum/discuss.php?d=232497","tags":["web"]},{"url":"https://moodle.org/mod/forum/discuss.php?d=232498","tags":["web"]},{"url":"https://moodle.org/mod/forum/discuss.php?d=232500","tags":["web"]},{"url":"https://moodle.org/mod/forum/discuss.php?d=232501","tags":["web"]},{"url":"https://moodle.org/mod/forum/discuss.php?d=232503","tags":["web"]},{"url":"http://docs.moodle.org/dev/Moodle_2.4.5_release_notes","tags":["web"]},{"url":"https://moodle.org/mod/forum/discuss.php?d=232108","tags":["web"]},{"url":"https://bugs.mageia.org/show_bug.cgi?id=10755","tags":["report"]}],"sources":{"cve":[{"id":"CVE-2013-2245","description":"rss/file.php in Moodle through 2.1.10, 2.2.x before 2.2.11, 2.3.x before 2.3.8, 2.4.x before 2.4.5, and 2.5.x before 2.5.1 does not properly implement the use of RSS tokens for impersonation, which allows remote authenticated users to obtain sensitive block information by reading an RSS feed.","status":"published","published":"2013-07-26T22:00:00Z","modified":"2024-09-16T18:43:55.716Z","updated_at":"2026-11-02T14:34:56.19172Z"}],"euvd":[{"id":"EUVD-2013-2196","description":"rss/file.php in Moodle through 2.1.10, 2.2.x before 2.2.11, 2.3.x before 2.3.8, 2.4.x before 2.4.5, and 2.5.x before 2.5.1 does not properly implement the use of RSS tokens for impersonation, which allows remote authenticated users to obtain sensitive block information by reading an RSS feed.","status":"published","published":"2013-07-26T22:00:00Z","modified":"2024-09-16T18:43:55Z","updated_at":"2026-11-03T00:55:29.674428Z"}],"ghsa":[{"id":"GHSA-9r38-f9p6-3f7p","title":"rss/file.php in Moodle through 2.1.10, 2.2.x before 2.2.11, 2.3.x before 2.3.8, 2.4.x before 2.4...","description":"rss/file.php in Moodle through 2.1.10, 2.2.x before 2.2.11, 2.3.x before 2.3.8, 2.4.x before 2.4.5, and 2.5.x before 2.5.1 does not properly implement the use of RSS tokens for impersonation, which allows remote authenticated users to obtain sensitive block information by reading an RSS feed.","status":"published","published":"2022-05-13T01:12:53Z","modified":"2023-02-01T05:03:54Z","cwes":["CWE-287"],"updated_at":"2026-11-02T14:50:06.799159Z"}],"nvd":[{"id":"CVE-2013-2245","description":"rss/file.php in Moodle through 2.1.10, 2.2.x before 2.2.11, 2.3.x before 2.3.8, 2.4.x before 2.4.5, and 2.5.x before 2.5.1 does not properly implement the use of RSS tokens for impersonation, which allows remote authenticated users to obtain sensitive block information by reading an RSS feed.","status":"published","published":"2013-07-29T13:59:20.7Z","modified":"2026-06-16T23:53:00.71Z","cvss":[{"version":"2.0","score":4,"vector":"AV:N/AC:L/Au:S/C:P/I:N/A:N","level":"medium","assessor":"primary"}],"cwes":["CWE-287"],"updated_at":"2026-11-02T14:02:31.592595Z"}],"osv":[{"id":"MGASA-2013-0217","title":"Updated moodle package fixes multiple security vulnerabilities","description":"Flash files distributed with the YUI library in Moodle before 2.4.5 may have\nallowed for cross-site scripting attacks (MSA-13-0025).\n\nPrivacy settings for the IMS-LTI (External tool) module in Moodle before\n2.4.5 were not able to be changed so personal information was always\ntransferred (MSA-13-0026).\n\nUsers were able to access a daemon-mode Chat activity in Moodle before 2.4.5\nwithout the required capability (CVE-2013-2242).\n\nIt was possible to determine answers from ID values in Lesson activity\nmatching questions in Moodle before 2.4.5 (CVE-2013-2243).\n\nConditional access rule values for user fields were able to contain unescaped\nHTML/JS that would be output to users in Moodle before 2.4.5 (CVE-2013-2244).\n\nWhen impersonating another user using RSS tokens in Moodle before 2.4.5, an\nerror was displayed, but block information relevant to the person being\nimpersonated was shown (CVE-2013-2245).\n\nThe Feedback module in Moodle before 2.4.5 was showing personal information \nto users without the needed capability (CVE-2013-2246).\n","status":"published","published":"2013-07-21T08:38:57Z","modified":"2026-04-16T04:41:18.867058487Z","updated_at":"2026-11-02T15:49:39.121227Z"}]}}