CVE-2013-4522: lib/filelib.php in Moodle through 2.2.11, 2.3.x before 2.3.10, 2.4.x before 2.4.7, and 2.5.x before 2.5.3 d...

Security readout for executives and security teams

This Moodle issue could let someone obtain files that another user previously accessed through a shared caching proxy. The problem is missing private cache-control headers on file responses. Business urgency depends heavily on whether the Moodle site sat behind shared or intermediary caching infrastructure. Exposure is most plausible for older Moodle deployments using shared caching proxies or intermediary caches that could store authenticated file responses. Sites not using such caches may have lower practical exposure, but version confirmation is still required. Prioritize remediation for internet-facing or widely used Moodle systems behind caching infrastructure. The issue is old and not KEV-listed, but it can expose sensitive learning materials or user files if legacy deployments remain unpatched. Mitigation focus: Upgrade Moodle to a fixed version or later for the affected branch.; Move Moodle 2.2 deployments to a supported, fixed Moodle branch.; Apply Moodle guidance associated with MDL-38743..

Prepared

Jun 14, 2026, 15:13 UTC (UTC+00:00)

Generated from the cited source records. This long-tail analysis has not been individually reviewed by a named human.