CVE-2013-1835: Moodle 2.x through 2.1.10, 2.2.x before 2.2.8, 2.3.x before 2.3.5, and 2.4.x before 2.4.2 allows remote aut...

Security readout for executives and security teams

This is a Moodle information-disclosure issue. A logged-in administrator could use the login-as capability to view sensitive information from other users' external repositories. The business risk is privacy exposure in older Moodle deployments, especially where external repository integrations hold student, staff, or institutional data. Exposure is limited to older Moodle instances in the listed version ranges, with external repositories enabled and users who have administrative login_as capability. The source bundle does not identify other affected products or configurations. Prioritize remediation for any internet-facing or institution-critical Moodle instance still running the affected 2013-era branches. The issue is not described as actively exploited, but it can expose sensitive user-linked repository data if administrator access is misused or compromised. Mitigation focus: Upgrade Moodle off the affected version ranges using Moodle or distribution guidance.; For Moodle 2.2, use 2.2.8 or later where applicable.; For Moodle 2.3, use 2.3.5 or later where applicable..

Prepared

Jun 24, 2026, 11:46 UTC (UTC+00:00)

Generated from the cited source records. This long-tail analysis has not been individually reviewed by a named human.