CVE-2013-4938

Severity: medium (CVSS 4.3 v2.0)
Exploited in the wild: not listed in CISA KEV
EPSS: 1.1% probability of exploitation in the next 30 days
Public exploit or detection template: none known
Published: 2013-07-29 · updated 2026-06-16
Weakness: CWE-264

Description

The LTI (aka IMS-LTI) mod_form implementation in Moodle through 2.1.10, 2.2.x before 2.2.11, 2.3.x before 2.3.8, 2.4.x before 2.4.5, and 2.5.x before 2.5.1 does not properly support the sendname, sendemailaddr, and acceptgrades settings, which allows remote attackers to obtain sensitive information in opportunistic circumstances by leveraging an environment in which there was an ineffective attempt to enable the more secure values.

Affected products

Moodle: 2.1.0, 2.1.1, 2.1.2, 2.1.3, 2.1.4, 2.1.5 (+30)

References

http://git.moodle.org/gw?p=moodle.git&a=search&h=HEAD&st=commit&s=MDL-40308
https://moodle.org/mod/forum/discuss.php?d=232497
http://git.moodle.org/gw?p=moodle.git&a=search&h=HEAD&st=commit&s=MDL-40308
https://moodle.org/mod/forum/discuss.php?d=232497

Get alerted when CVE-2013-4938 or the next vulnerability affects your stack