CVE-2013-2080

Severity: medium (CVSS 4.0 v2.0)
Exploited in the wild: not listed in CISA KEV
EPSS: 1.8% probability of exploitation in the next 30 days
Public exploit or detection template: none known
Published: 2013-05-25 · updated 2026-06-16
Weakness: CWE-264

Description

The core_grade component in Moodle through 2.2.10, 2.3.x before 2.3.7, and 2.4.x before 2.4.4 does not properly consider the existence of hidden grades, which allows remote authenticated users to obtain sensitive information by leveraging the student role and reading the Gradebook Overview report.

Affected products

Moodle: 2.2.0, 2.2.1, 2.2.2, 2.2.3, 2.2.4, 2.2.5 (+16)

References

http://git.moodle.org/gw?p=moodle.git&a=search&h=HEAD&st=commit&s=MDL-37475
http://lists.fedoraproject.org/pipermail/package-announce/2013-May/106965.html
http://lists.fedoraproject.org/pipermail/package-announce/2013-May/106988.html
http://lists.fedoraproject.org/pipermail/package-announce/2013-May/107026.html
http://openwall.com/lists/oss-security/2013/05/21/1
https://moodle.org/mod/forum/discuss.php?d=228931
http://git.moodle.org/gw?p=moodle.git&a=search&h=HEAD&st=commit&s=MDL-37475
http://lists.fedoraproject.org/pipermail/package-announce/2013-May/106965.html
http://lists.fedoraproject.org/pipermail/package-announce/2013-May/106988.html
http://lists.fedoraproject.org/pipermail/package-announce/2013-May/107026.html
http://openwall.com/lists/oss-security/2013/05/21/1
https://moodle.org/mod/forum/discuss.php?d=228931

Get alerted when CVE-2013-2080 or the next vulnerability affects your stack