CVE-2013-4938: The LTI (aka IMS-LTI) mod_form implementation in Moodle through 2.1.10, 2.2.x before 2.2.11, 2.3.x before 2...

Security readout for executives and security teams

This Moodle flaw could expose learner or user information through LTI integrations when administrators believed safer privacy settings were enabled. The issue is conditional and old, but it matters for legacy Moodle installations that still use affected LTI code paths. Exposure is most plausible on legacy Moodle sites running affected versions and using IMS-LTI/LTI activities with privacy or grade-return settings. The bundle provides no CPEs, deployment telemetry, or evidence about current internet exposure. Treat as a legacy platform risk. It is unlikely to be urgent for modern Moodle, but any still-running affected Moodle instance handling student or employee data should be prioritized for upgrade and privacy-setting verification. Mitigation focus: Upgrade affected Moodle branches to fixed versions or later.; Move off Moodle 2.1.x if still present; the bundle names no fixed 2.1 release.; Review Moodle advisory and MDL-40308 commit references for vendor-specific guidance..

Prepared

Jun 14, 2026, 21:50 UTC (UTC+00:00)

Generated from the cited source records. This long-tail analysis has not been individually reviewed by a named human.