4.3

CVE-2025-3634

Moodle: moodle allows course self-enrolment before completing mfa

Self enrolment available before completing second factor with MFA enabled

A security vulnerability was discovered in Moodle that allows students to enroll themselves in courses without completing all the necessary safety checks. Specifically, users can sign up for courses prematurely, even if they haven't finished two-step verification processes.
Mögliche Gegenmaßnahme
Moodle Server: Update to a patched version.
Daten sind bereitgestellt durch das CVE Programm von einer CVE Numbering Authority (CNA) (Unstrukturiert).
Collection URLhttps://git.moodle.org
≫
Paket moodle
Default Statusunaffected
Version 4.5.0
Version < 4.5.4
Status affected
Version 4.4.0
Version < 4.4.8
Status affected
Version 4.3.0
Version < 4.3.12
Status affected
VulnDex Vulnerability Enrichment
Diese Information steht angemeldeten Benutzern zur Verfügung. Login Login
Weitere Schwachstelleninformationen
SystemMoodle
≫
Produkt Moodle Server
Version >= 4.5.0, < 4.5.4
Version >= 4.4.0, < 4.4.8
Version >= 4.3.0, < 4.3.12
Zu dieser CVE wurde keine Warnung gefunden.
EPSS Metriken
Typ Quelle Score Percentile
EPSS FIRST.org 0.32% 0.544
CVSS Metriken
Quelle Base Score Exploit Score Impact Score Vector String
patrick@puiterwijk.org 4.3 2.8 1.4
CVSS:3.1/AV:N/AC:L/PR:L/UI:N/S:U/C:N/I:L/A:N
CWE-287 Improper Authentication

When an actor claims to have a given identity, the product does not prove or insufficiently proves that the claim is correct.