7.1

CVE-2025-3625

Medienbericht

Moodle: user dos and name disclosure via idor in moodle mfa email factor revoke action

User DoS and name disclosure risks via IDOR in MFA email factor revoke action

A security vulnerability was discovered in Moodle that can allow hackers to gain access to sensitive information about students and prevent them from logging into their accounts, even after they had completed two-factor authentication (2FA).
Mögliche Gegenmaßnahme
Moodle Server: Update to a patched version.
Daten sind bereitgestellt durch das CVE Programm von einer CVE Numbering Authority (CNA) (Unstrukturiert).
Collection URLhttps://git.moodle.org
≫
Paket moodle
Default Statusunaffected
Version 4.5.0
Version < 4.5.4
Status affected
Version 4.4.0
Version < 4.4.8
Status affected
Version 4.3.0
Version < 4.3.12
Status affected
VulnDex Vulnerability Enrichment
Diese Information steht angemeldeten Benutzern zur Verfügung. Login Login
Weitere Schwachstelleninformationen
SystemMoodle
≫
Produkt Moodle Server
Version >= 4.5.0, < 4.5.4
Version >= 4.4.0, < 4.4.8
Version >= 4.3.0, < 4.3.12
Zu dieser CVE wurde keine Warnung gefunden.
EPSS Metriken
Typ Quelle Score Percentile
EPSS FIRST.org 0.27% 0.5
CVSS Metriken
Quelle Base Score Exploit Score Impact Score Vector String
patrick@puiterwijk.org 7.1 2.8 4.2
CVSS:3.1/AV:N/AC:L/PR:L/UI:N/S:U/C:L/I:N/A:H
CWE-639 Authorization Bypass Through User-Controlled Key

The system's authorization functionality does not prevent one user from gaining access to another user's data or record by modifying the key value identifying the data.