Description

Moodle through 2.1.10, 2.2.x before 2.2.10, 2.3.x before 2.3.7, and 2.4.x before 2.4.4 does not enforce capability requirements for reading blog comments, which allows remote attackers to obtain sensitive information via a crafted request.

Remediation

References

CVE-2013-2082

Related Vulnerabilities

Oracle HTTP Server Server-Side Request Forgery (SSRF) Vulnerability (CVE-2021-40438)

SugarCRM Improper Control of Generation of Code ('Code Injection') Vulnerability (CVE-2019-17306)

WordPress Plugin SEO Redirection-301 Redirect Manager Multiple Cross-Site Scripting Vulnerabilities (2.8)

MySQL CVE-2020-14586 Vulnerability (CVE-2020-14586)

osCommerce Improper Neutralization of Input During Web Page Generation ('Cross-site Scripting') Vulnerability (CVE-2023-43732)

Severity

Medium

Classification

CVE-2013-2082 CWE-264

Tags

Missing Update Known Vulnerabilities