Description

Moodle through 2.1.10, 2.2.x before 2.2.10, 2.3.x before 2.3.7, and 2.4.x before 2.4.4 does not consider "don't send" attributes during hub registration, which allows remote hubs to obtain sensitive site information by reading form data.

Remediation

References

CVE-2013-2081

Related Vulnerabilities

MySQL CVE-2012-1697 Vulnerability (CVE-2012-1697)

PHP Address Book Improper Neutralization of Special Elements used in an SQL Command ('SQL Injection') Vulnerability (CVE-2013-0135)

WordPress Plugin Product list Widget for Woocommerce Cross-Site Scripting (1.0)

TYPO3 Improper Authentication Vulnerability (CVE-2014-3944)

Oracle Application Server CVE-2009-3412 Vulnerability (CVE-2009-3412)

Severity

Medium

Classification

CVE-2013-2081 CWE-264

Tags

Missing Update Known Vulnerabilities