Moodle CVE-2013-2245 Information Disclosure Vulnerability

Bugtraq ID:	61184
Class:	Design Error
CVE:	CVE-2013-2245
Remote:	Yes
Local:	No
Published:	Jul 15 2013 12:00AM
Updated:	May 07 2015 05:04PM
Credit:	Dan Marsden
Vulnerable:	Moodle Moodle 2.4.4 Moodle Moodle 2.4.3 Moodle Moodle 2.3.7 Moodle Moodle 2.3.6 Moodle Moodle 2.3.3 Moodle Moodle 2.3.2 Moodle Moodle 2.3.1 Moodle Moodle 2.2.10 Moodle Moodle 2.2.9 Moodle Moodle 2.2.6 Moodle Moodle 2.2.5 Moodle Moodle 2.2.4 Moodle Moodle 2.2.3 Moodle Moodle 2.2.2 Moodle Moodle 2.5 Moodle Moodle 2.4.2 Moodle Moodle 2.4.1 Moodle Moodle 2.4 Moodle Moodle 2.3.5 Moodle Moodle 2.3.4 Moodle Moodle 2.3 Moodle Moodle 2.2.8 Moodle Moodle 2.2.7
Not Vulnerable:	Moodle Moodle 2.5.1 Moodle Moodle 2.4.5 Moodle Moodle 2.3.8 Moodle Moodle 2.2.11

Moodle CVE-2013-2245 Information Disclosure Vulnerability

Moodle is prone to an information-disclosure vulnerability.

Attackers can exploit this issue to obtain sensitive information that may aid in launching further attacks.

The following versions are vulnerable:

Moodle 2.5
Moodle 2.4 through 2.4.4
Moodle 2.3 through 2.3.7
Moodle 2.2 through 2.2.10

Moodle CVE-2013-2245 Information Disclosure Vulnerability

An attacker can exploit this issue using a web browser.

Moodle CVE-2013-2245 Information Disclosure Vulnerability

Solution:
Updates are available. Please see the references or vendor advisory for more information.

Moodle CVE-2013-2245 Information Disclosure Vulnerability

References:

• Moodle Homepage (Moodle)
  
• MSA-13-0030: Information leak through RSS (Michael de Raadt)