VYPR
← All advisories
Moderate severityNVD Advisory· Published Nov 26, 2013· Updated Apr 29, 2026

CVE-2013-4522

CVE-2013-4522

Description

lib/filelib.php in Moodle through 2.2.11, 2.3.x before 2.3.10, 2.4.x before 2.4.7, and 2.5.x before 2.5.3 does not send "Cache-Control: private" HTTP headers, which allows remote attackers to obtain sensitive information by requesting a file that had been previously retrieved by a caching proxy server.

Affected packages

Versions sourced from the GitHub Security Advisory.

PackageAffected versionsPatched versions
moodle/moodlePackagist
< 2.3.102.3.10
moodle/moodlePackagist
>= 2.4.0-beta, < 2.4.72.4.7
moodle/moodlePackagist
>= 2.5.0-beta, < 2.5.32.5.3

Affected products

118
  • Moodle/Moodle118 versions
    cpe:2.3:a:moodle:moodle:*:*:*:*:*:*:*:*+ 117 more
    • cpe:2.3:a:moodle:moodle:*:*:*:*:*:*:*:*range: <=2.2.11
    • cpe:2.3:a:moodle:moodle:1.1.1:*:*:*:*:*:*:*
    • cpe:2.3:a:moodle:moodle:1.2.0:*:*:*:*:*:*:*
    • cpe:2.3:a:moodle:moodle:1.2.1:*:*:*:*:*:*:*
    • cpe:2.3:a:moodle:moodle:1.3.0:*:*:*:*:*:*:*
    • cpe:2.3:a:moodle:moodle:1.3.1:*:*:*:*:*:*:*
    • cpe:2.3:a:moodle:moodle:1.3.2:*:*:*:*:*:*:*
    • cpe:2.3:a:moodle:moodle:1.3.3:*:*:*:*:*:*:*
    • cpe:2.3:a:moodle:moodle:1.3.4:*:*:*:*:*:*:*
    • cpe:2.3:a:moodle:moodle:1.4.1:*:*:*:*:*:*:*
    • cpe:2.3:a:moodle:moodle:1.4.2:*:*:*:*:*:*:*
    • cpe:2.3:a:moodle:moodle:1.4.3:*:*:*:*:*:*:*
    • cpe:2.3:a:moodle:moodle:1.4.4:*:*:*:*:*:*:*
    • cpe:2.3:a:moodle:moodle:1.4.5:*:*:*:*:*:*:*
    • cpe:2.3:a:moodle:moodle:1.5:*:*:*:*:*:*:*
    • cpe:2.3:a:moodle:moodle:1.5.0:beta:*:*:*:*:*:*
    • cpe:2.3:a:moodle:moodle:1.5.1:*:*:*:*:*:*:*
    • cpe:2.3:a:moodle:moodle:1.5.2:*:*:*:*:*:*:*
    • cpe:2.3:a:moodle:moodle:1.5.3:*:*:*:*:*:*:*
    • cpe:2.3:a:moodle:moodle:1.6.0:*:*:*:*:*:*:*
    • cpe:2.3:a:moodle:moodle:1.6.1:*:*:*:*:*:*:*
    • cpe:2.3:a:moodle:moodle:1.6.2:*:*:*:*:*:*:*
    • cpe:2.3:a:moodle:moodle:1.6.3:*:*:*:*:*:*:*
    • cpe:2.3:a:moodle:moodle:1.6.4:*:*:*:*:*:*:*
    • cpe:2.3:a:moodle:moodle:1.6.5:*:*:*:*:*:*:*
    • cpe:2.3:a:moodle:moodle:1.6.6:*:*:*:*:*:*:*
    • cpe:2.3:a:moodle:moodle:1.6.7:*:*:*:*:*:*:*
    • cpe:2.3:a:moodle:moodle:1.6.8:*:*:*:*:*:*:*
    • cpe:2.3:a:moodle:moodle:1.7.1:*:*:*:*:*:*:*
    • cpe:2.3:a:moodle:moodle:1.7.2:*:*:*:*:*:*:*
    • cpe:2.3:a:moodle:moodle:1.7.3:*:*:*:*:*:*:*
    • cpe:2.3:a:moodle:moodle:1.7.4:*:*:*:*:*:*:*
    • cpe:2.3:a:moodle:moodle:1.7.5:*:*:*:*:*:*:*
    • cpe:2.3:a:moodle:moodle:1.7.6:*:*:*:*:*:*:*
    • cpe:2.3:a:moodle:moodle:1.8.1:*:*:*:*:*:*:*
    • cpe:2.3:a:moodle:moodle:1.8.10:*:*:*:*:*:*:*
    • cpe:2.3:a:moodle:moodle:1.8.11:*:*:*:*:*:*:*
    • cpe:2.3:a:moodle:moodle:1.8.12:*:*:*:*:*:*:*
    • cpe:2.3:a:moodle:moodle:1.8.13:*:*:*:*:*:*:*
    • cpe:2.3:a:moodle:moodle:1.8.14:*:*:*:*:*:*:*
    • cpe:2.3:a:moodle:moodle:1.8.2:*:*:*:*:*:*:*
    • cpe:2.3:a:moodle:moodle:1.8.3:*:*:*:*:*:*:*
    • cpe:2.3:a:moodle:moodle:1.8.4:*:*:*:*:*:*:*
    • cpe:2.3:a:moodle:moodle:1.8.5:*:*:*:*:*:*:*
    • cpe:2.3:a:moodle:moodle:1.8.6:*:*:*:*:*:*:*
    • cpe:2.3:a:moodle:moodle:1.8.7:*:*:*:*:*:*:*
    • cpe:2.3:a:moodle:moodle:1.8.8:*:*:*:*:*:*:*
    • cpe:2.3:a:moodle:moodle:1.8.9:*:*:*:*:*:*:*
    • cpe:2.3:a:moodle:moodle:1.9.1:*:*:*:*:*:*:*
    • cpe:2.3:a:moodle:moodle:1.9.10:*:*:*:*:*:*:*
    • cpe:2.3:a:moodle:moodle:1.9.11:*:*:*:*:*:*:*
    • cpe:2.3:a:moodle:moodle:1.9.12:*:*:*:*:*:*:*
    • cpe:2.3:a:moodle:moodle:1.9.13:*:*:*:*:*:*:*
    • cpe:2.3:a:moodle:moodle:1.9.14:*:*:*:*:*:*:*
    • cpe:2.3:a:moodle:moodle:1.9.15:*:*:*:*:*:*:*
    • cpe:2.3:a:moodle:moodle:1.9.16:*:*:*:*:*:*:*
    • cpe:2.3:a:moodle:moodle:1.9.17:*:*:*:*:*:*:*
    • cpe:2.3:a:moodle:moodle:1.9.18:*:*:*:*:*:*:*
    • cpe:2.3:a:moodle:moodle:1.9.2:*:*:*:*:*:*:*
    • cpe:2.3:a:moodle:moodle:1.9.3:*:*:*:*:*:*:*
    • cpe:2.3:a:moodle:moodle:1.9.4:*:*:*:*:*:*:*
    • cpe:2.3:a:moodle:moodle:1.9.5:*:*:*:*:*:*:*
    • cpe:2.3:a:moodle:moodle:1.9.6:*:*:*:*:*:*:*
    • cpe:2.3:a:moodle:moodle:1.9.7:*:*:*:*:*:*:*
    • cpe:2.3:a:moodle:moodle:1.9.8:*:*:*:*:*:*:*
    • cpe:2.3:a:moodle:moodle:1.9.9:*:*:*:*:*:*:*
    • cpe:2.3:a:moodle:moodle:2.0.0:*:*:*:*:*:*:*
    • cpe:2.3:a:moodle:moodle:2.0.1:*:*:*:*:*:*:*
    • cpe:2.3:a:moodle:moodle:2.0.2:*:*:*:*:*:*:*
    • cpe:2.3:a:moodle:moodle:2.0.3:*:*:*:*:*:*:*
    • cpe:2.3:a:moodle:moodle:2.0.4:*:*:*:*:*:*:*
    • cpe:2.3:a:moodle:moodle:2.0.5:*:*:*:*:*:*:*
    • cpe:2.3:a:moodle:moodle:2.0.6:*:*:*:*:*:*:*
    • cpe:2.3:a:moodle:moodle:2.0.7:*:*:*:*:*:*:*
    • cpe:2.3:a:moodle:moodle:2.0.8:*:*:*:*:*:*:*
    • cpe:2.3:a:moodle:moodle:2.0.9:*:*:*:*:*:*:*
    • cpe:2.3:a:moodle:moodle:2.1.0:*:*:*:*:*:*:*
    • cpe:2.3:a:moodle:moodle:2.1.1:*:*:*:*:*:*:*
    • cpe:2.3:a:moodle:moodle:2.1.10:*:*:*:*:*:*:*
    • cpe:2.3:a:moodle:moodle:2.1.2:*:*:*:*:*:*:*
    • cpe:2.3:a:moodle:moodle:2.1.3:*:*:*:*:*:*:*
    • cpe:2.3:a:moodle:moodle:2.1.4:*:*:*:*:*:*:*
    • cpe:2.3:a:moodle:moodle:2.1.5:*:*:*:*:*:*:*
    • cpe:2.3:a:moodle:moodle:2.1.6:*:*:*:*:*:*:*
    • cpe:2.3:a:moodle:moodle:2.1.7:*:*:*:*:*:*:*
    • cpe:2.3:a:moodle:moodle:2.1.8:*:*:*:*:*:*:*
    • cpe:2.3:a:moodle:moodle:2.1.9:*:*:*:*:*:*:*
    • cpe:2.3:a:moodle:moodle:2.2.0:*:*:*:*:*:*:*
    • cpe:2.3:a:moodle:moodle:2.2.1:*:*:*:*:*:*:*
    • cpe:2.3:a:moodle:moodle:2.2.10:*:*:*:*:*:*:*
    • cpe:2.3:a:moodle:moodle:2.2.2:*:*:*:*:*:*:*
    • cpe:2.3:a:moodle:moodle:2.2.3:*:*:*:*:*:*:*
    • cpe:2.3:a:moodle:moodle:2.2.4:*:*:*:*:*:*:*
    • cpe:2.3:a:moodle:moodle:2.2.5:*:*:*:*:*:*:*
    • cpe:2.3:a:moodle:moodle:2.2.6:*:*:*:*:*:*:*
    • cpe:2.3:a:moodle:moodle:2.2.7:*:*:*:*:*:*:*
    • cpe:2.3:a:moodle:moodle:2.2.8:*:*:*:*:*:*:*
    • cpe:2.3:a:moodle:moodle:2.2.9:*:*:*:*:*:*:*
    • cpe:2.3:a:moodle:moodle:2.3.0:*:*:*:*:*:*:*
    • cpe:2.3:a:moodle:moodle:2.3.1:*:*:*:*:*:*:*
    • cpe:2.3:a:moodle:moodle:2.3.2:*:*:*:*:*:*:*
    • cpe:2.3:a:moodle:moodle:2.3.3:*:*:*:*:*:*:*
    • cpe:2.3:a:moodle:moodle:2.3.4:*:*:*:*:*:*:*
    • cpe:2.3:a:moodle:moodle:2.3.5:*:*:*:*:*:*:*
    • cpe:2.3:a:moodle:moodle:2.3.6:*:*:*:*:*:*:*
    • cpe:2.3:a:moodle:moodle:2.3.7:*:*:*:*:*:*:*
    • cpe:2.3:a:moodle:moodle:2.3.8:*:*:*:*:*:*:*
    • cpe:2.3:a:moodle:moodle:2.3.9:*:*:*:*:*:*:*
    • cpe:2.3:a:moodle:moodle:2.4.0:*:*:*:*:*:*:*
    • cpe:2.3:a:moodle:moodle:2.4.1:*:*:*:*:*:*:*
    • cpe:2.3:a:moodle:moodle:2.4.2:*:*:*:*:*:*:*
    • cpe:2.3:a:moodle:moodle:2.4.3:*:*:*:*:*:*:*
    • cpe:2.3:a:moodle:moodle:2.4.4:*:*:*:*:*:*:*
    • cpe:2.3:a:moodle:moodle:2.4.5:*:*:*:*:*:*:*
    • cpe:2.3:a:moodle:moodle:2.4.6:*:*:*:*:*:*:*
    • cpe:2.3:a:moodle:moodle:2.5.0:*:*:*:*:*:*:*
    • cpe:2.3:a:moodle:moodle:2.5.1:*:*:*:*:*:*:*
    • cpe:2.3:a:moodle:moodle:2.5.2:*:*:*:*:*:*:*

Patches

1
d0041fb11020

Merge branch 'w43_MDL-38743_m26_private' of https://github.com/skodak/moodle

https://github.com/moodle/moodleDan PoltawskiOct 23, 2013via ghsa
commit
1 file changed · +13 −5
  • lib/filelib.php+13 −5 modified
    @@ -2188,7 +2188,7 @@ function send_temp_file($path, $filename, $pathisstring=false) {
 
     header('Content-Disposition: attachment; filename="'.$filename.'"');
     if (strpos($CFG->wwwroot, 'https://') === 0) { //https sites - watch out for IE! KB812935 and KB316431
-        header('Cache-Control: max-age=10');
+        header('Cache-Control: private, max-age=10');
         header('Expires: '. gmdate('D, d M Y H:i:s', 0) .' GMT');
         header('Pragma: ');
     } else { //normal http - prevent caching at all cost
@@ -2274,15 +2274,19 @@ function send_file($path, $filename, $lifetime = 'default' , $filter=0, $pathiss
     }
 
     if ($lifetime > 0) {
+        $private = '';
+        if (isloggedin() and !isguestuser()) {
+            $private = ' private,';
+        }
         $nobyteserving = false;
-        header('Cache-Control: max-age='.$lifetime);
+        header('Cache-Control:'.$private.' max-age='.$lifetime);
         header('Expires: '. gmdate('D, d M Y H:i:s', time() + $lifetime) .' GMT');
         header('Pragma: ');
 
     } else { // Do not cache files in proxies and browsers
         $nobyteserving = true;
         if (strpos($CFG->wwwroot, 'https://') === 0) { //https sites - watch out for IE! KB812935 and KB316431
-            header('Cache-Control: max-age=10');
+            header('Cache-Control: private, max-age=10');
             header('Expires: '. gmdate('D, d M Y H:i:s', 0) .' GMT');
             header('Pragma: ');
         } else { //normal http - prevent caching at all cost
@@ -2438,13 +2442,17 @@ function send_stored_file($stored_file, $lifetime=86400 , $filter=0, $forcedownl
     }
 
     if ($lifetime > 0) {
-        header('Cache-Control: max-age='.$lifetime);
+        $private = '';
+        if (isloggedin() and !isguestuser()) {
+            $private = ' private,';
+        }
+        header('Cache-Control:'.$private.' max-age='.$lifetime);
         header('Expires: '. gmdate('D, d M Y H:i:s', time() + $lifetime) .' GMT');
         header('Pragma: ');
 
     } else { // Do not cache files in proxies and browsers
         if (strpos($CFG->wwwroot, 'https://') === 0) { //https sites - watch out for IE! KB812935 and KB316431
-            header('Cache-Control: max-age=10');
+            header('Cache-Control: private, max-age=10');
             header('Expires: '. gmdate('D, d M Y H:i:s', 0) .' GMT');
             header('Pragma: ');
         } else { //normal http - prevent caching at all cost

Vulnerability mechanics

Generated by null/stub on May 9, 2026. Inputs: CWE entries + fix-commit diffs from this CVE's patches. Citations validated against bundle.

References

5

News mentions

0

No linked articles in our index yet.