Description

Moodle 2.x through 2.1.10, 2.2.x before 2.2.8, 2.3.x before 2.3.5, and 2.4.x before 2.4.2 allows remote authenticated administrators to obtain sensitive information from the external repositories of arbitrary users by leveraging the login_as feature.

Remediation

References

CVE-2013-1835

Related Vulnerabilities

PHP NULL Pointer Dereference Vulnerability (CVE-2026-7262)

EspoCRM Improper Restriction of Excessive Authentication Attempts Vulnerability (CVE-2019-14351)

phpMyAdmin Improper Neutralization of Special Elements used in an SQL Command ('SQL Injection') Vulnerability (CVE-2005-4349)

WordPress Plugin All-in-One Event Calendar Multiple Vulnerabilities (1.10-standard)

WordPress Plugin Popup by Supsystic Cross-Site Request Forgery (1.7.8)

Severity

Low

Classification

CVE-2013-1835 CWE-200

Tags

Missing Update Known Vulnerabilities