Moodle CVE-2013-1836 Security Bypass Vulnerability

Bugtraq ID:	60048
Class:	Design Error
CVE:	CVE-2013-1836
Remote:	Yes
Local:	No
Published:	Mar 25 2013 12:00AM
Updated:	Apr 13 2015 09:37PM
Credit:	Frédéric Massart
Vulnerable:	Moodle Moodle 2.3.3 Moodle Moodle 2.3.2 Moodle Moodle 2.3.1 Moodle Moodle 2.2.6 Moodle Moodle 2.2.5 Moodle Moodle 2.2.4 Moodle Moodle 2.2.3 Moodle Moodle 2.2.2 Moodle Moodle 2.2.1 Moodle Moodle 2.1.9 Moodle Moodle 2.1.8 Moodle Moodle 2.1.7 Moodle Moodle 2.1.6 Moodle Moodle 2.1.5 Moodle Moodle 2.1.4 Moodle Moodle 2.1.2 Moodle Moodle 2.1.1 Moodle Moodle 2.0.10 Moodle Moodle 2.0.9 Moodle Moodle 2.0.8 Moodle Moodle 2.0.7 Moodle Moodle 2.0.5 Moodle Moodle 2.0.4 Moodle Moodle 2.0.3 Moodle Moodle 2.0.2 Moodle Moodle 2.0.1 Moodle Moodle 2.4.1 Moodle Moodle 2.4 Moodle Moodle 2.3.4 Moodle Moodle 2.3 Moodle Moodle 2.2.7 Moodle Moodle 2.2 Moodle Moodle 2.1.3 Moodle Moodle 2.1.10 Moodle Moodle 2.1 Moodle Moodle 2.0.6
Not Vulnerable:	Moodle Moodle 2.4.2 Moodle Moodle 2.3.5 Moodle Moodle 2.2.8

Moodle CVE-2013-1836 Security Bypass Vulnerability

Moodle is prone to a security-bypass vulnerability.

An attacker may exploit this issue to bypass certain security restrictions and perform unauthorized actions.

Note: This issue was previously discussed in BID 58660 (Moodle Multiple Remote Security Vulnerabilities), but has been moved to its own record for better documentation.

Moodle CVE-2013-1836 Security Bypass Vulnerability

An attacker can exploit this issue using a web browser.

Moodle CVE-2013-1836 Security Bypass Vulnerability

References:

• Moodle Homepage (Moodle)
  
• MSA-13-0019: Unauthorised settings editing through WebDav repository (Frédéric Massart)