CVE Vulnerabilities

CVE-2013-2245

Improper Authentication

Published: Jul 29, 2013 | Modified: Dec 01, 2020
CVSS 3.x
N/A
Source:
NVD
CVSS 2.x
4 MEDIUM
AV:N/AC:L/Au:S/C:P/I:N/A:N
RedHat/V2
RedHat/V3
Ubuntu
LOW

rss/file.php in Moodle through 2.1.10, 2.2.x before 2.2.11, 2.3.x before 2.3.8, 2.4.x before 2.4.5, and 2.5.x before 2.5.1 does not properly implement the use of RSS tokens for impersonation, which allows remote authenticated users to obtain sensitive block information by reading an RSS feed.

Weakness

When an actor claims to have a given identity, the product does not prove or insufficiently proves that the claim is correct.

Affected Software

Name Vendor Start Version End Version
Moodle Moodle 2.1.0 (including) 2.1.0 (including)
Moodle Moodle 2.1.1 (including) 2.1.1 (including)
Moodle Moodle 2.1.2 (including) 2.1.2 (including)
Moodle Moodle 2.1.3 (including) 2.1.3 (including)
Moodle Moodle 2.1.4 (including) 2.1.4 (including)
Moodle Moodle 2.1.5 (including) 2.1.5 (including)
Moodle Moodle 2.1.6 (including) 2.1.6 (including)
Moodle Moodle 2.1.7 (including) 2.1.7 (including)
Moodle Moodle 2.1.8 (including) 2.1.8 (including)
Moodle Moodle 2.1.9 (including) 2.1.9 (including)
Moodle Moodle 2.1.10 (including) 2.1.10 (including)
Moodle Ubuntu lucid *
Moodle Ubuntu precise *
Moodle Ubuntu quantal *
Moodle Ubuntu raring *
Moodle Ubuntu upstream *

Potential Mitigations

References