CVE-2013-2245

rss/file.php in Moodle through 2.1.10, 2.2.x before 2.2.11, 2.3.x before 2.3.8, 2.4.x before 2.4.5, and 2.5.x before 2.5.1 does not properly implement the use of RSS tokens for impersonation, which allows remote authenticated users to obtain sensitive block information by reading an RSS feed.

Score

CVSS 2.0 4.0 Medium

Status

Modified - secalert@redhat.com

Published

2013-07-29

Last modified

2024-09-16

Weaknesses

CWE-287

Affected products

• Moodle (Moodle)

References

• http://git.moodle.org/gw?p=moodle.git&a=search&h=HEAD&st=commit&s=MDL-37818
• https://moodle.org/mod/forum/discuss.php?d=232502